Capturing packets
Filters, what gets decoded, and where this stops being the right tool.
Before you start
- Npcap installed
- Administrator rights
Capture on one adapter or all of them at once. Windows only exposes raw capture to an elevated process, so this is the one feature that needs administrator rights.
Filters
Two kinds, and the difference matters:
- Address, port and protocol are compiled to a BPF filter and applied by the driver, before packets reach the app. These are set before the capture starts and are the ones that keep a busy link manageable.
- Application and keyword filters are matched after decoding, so they can be changed while the capture is running without losing what you already have.
What is decoded
Ethernet, IPv4, IPv6, ARP, TCP, UDP and ICMP, to one line per packet. Common applications are identified, DNS queries are summarised, and HTTP request lines are shown.
Where this stops
There is no packet detail tree, no hex view, no follow-stream, and no reading or writing of pcap files. This is a visibility check — is the traffic arriving, and from whom. For real trace analysis use Wireshark, which is free and better at it. Nothing here is trying to replace it.