[Winpcap-users] Query Regarding WinPcap 4.0.2.

Gianluca Varenni gianluca.varenni at cacetech.com
Tue Nov 11 15:41:09 GMT 2008

First of all, a bit of clarification on how the "system32" folder works on 64bit systems.

Physically, on a 64bit system, the core dlls are stored into two folders:
- c:\windows\system32 contains the 64bit version of the core DLLs.
- c:\windows\sysWOW64 contains the 32bit version of the same core DLLs.

The drivers always reside under c:\windows\system32\drivers, because on a 64bit machine all the kernel mode drivers should be 64bit.

When a 32bit application runs on a 64bit system, the OS uses a file system redirector, so that all the requests (done by the 32bit application) to a file in c:\windows\system32 get redirected to c:\windows\sysWOW64

Going back to WinPcap (4.0.2), on a 64 bit system npf.sys resides in c:\windows\system32\drivers (because it's a 64bit driver) and all the user mode DLLs reside in c:\windows\sysWOW64 (since they are 32bit DLLs). 

I don't know exactly why you want to move wpcap.dll to another folder, but it should definitely work with these caveats:
- you CANNOT copy wpcap.dll into c:\windows\system32, where the 64bit OS DLLs are located. Your application will never be able to access that folder because it's hidden by the FS redirector (this is not 100% true, as there is a way to disable the FS redirector)
- if you try to load wpcap.dll located in c:\windows\sysWOW64 (i.e. the default install location), you need to do LoadLibrary("C:\\windows\\system32\\wpcap.dll", 0). 

Regarding npf.sys, that file should always reside in c:\windows\system32\drivers

Regarding a silent version of the installer, for a number of reasons this option is not available.

Have a nice day

----- Original Message ----- 
  From: naveen kumar 
  To: winpcap-users at winpcap.org 
  Sent: Tuesday, November 11, 2008 6:45 AM
  Subject: [Winpcap-users] Query Regarding WinPcap 4.0.2.

  Hi All,

  I have a query regarding the winpcap 4.0.2. my application is using for pocket capturing using winpcap and nps.sys driver. Previously I was using the winpcap in my application it was working fine for me for both windows 2000 and windows 2003 32 bit OS. 

  I want to support my application on windows server 2003 64 bit OS and windows vista , so i used the winpcap latest version 4.0.2 with my application.

  My application dll uses the load library windows api to load the wpcap.dll. If i copy this wpcap.dll to the sysWOW64 directory my dll will perfectly load the wpcap.dll and it will also load the npf.sys from system32\drivers directory and rest of the things work fine. but my application dll is failing to load the 4.0.2 wpcap.dll, if i copy the dll to directory other than system32 in the 64 bit OS of windows server 2003, even though i am giving the absolute path of the location to load wpcap.dll in loadlibrary API. 

  if i use the wpcap.dll of version in location other than sysWOW64 my Application dll loads the wpcap.dll, but it fails to load the npf.sys driver from the same location where dll is present. 

  My query is wheather the latest wpcap.dll and npf.sys should always available in the sysWOW64 and system32\drivers directory for the 64 bit windows 2003?

  One more Query 
  is it possible to run the Winpcap installation as a silent installation? 

  If you have any concerns please let me know. Thanks in advance.


  Give the world a slice of your life. Get a Live.in id Check it out! 


  Winpcap-users mailing list
  Winpcap-users at winpcap.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20081111/3667c530/attachment.htm

More information about the Winpcap-users mailing list