# Can Packetbeat be configured to use Npcap by default?

**URL:** <https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [May 17, 2017, 7:24pm UTC](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166 "2017-05-17T19:24:53Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bobby](https://avatars.discourse-cdn.com/v4/letter/b/df788c/32.png) [@Bobby](https://discuss.elastic.co/u/Bobby)\
**Post date:** [May 17, 2017, 7:24pm UTC](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166/1 "2017-05-17T19:24:53Z")

</div>

In this part of [Packetbeat's FAQ section](https://www.elastic.co/guide/en/beats/packetbeat/current/faq.html#packetbeat-loopback-interface), Npcap is mentioned to be an alternative to WinPcap. I tried running Packetbeat after installing Npcap, but still hit the error "The program can't start because wpcap.dll is missing from your computer"

Npcap has a "WinPCap compatibility mode" that should do the trick, but I'm having a little trouble determining how to use that setting during a silent install process.

It'd be much easier if Packetbeat would be able to use Npcap directly. Given Npcap is mentioned as an alternative in the FAQ, is there a way to have Packetbeat use it directly that I'm not aware of?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 18, 2017, 12:55am UTC](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166/2 "2017-05-18T00:55:00Z")

</div>

I have used npcap with Packetbeat [in the past](https://github.com/elastic/beats/issues/104#issuecomment-199525840). All I recall needing to do was uninstall winpcap, install npcap, and restart the box.

---

<div class="post-metadata">

**Author:** ![Bobby](https://avatars.discourse-cdn.com/v4/letter/b/df788c/32.png) [@Bobby](https://discuss.elastic.co/u/Bobby)\
**Post date:** [May 19, 2017, 6:12pm UTC](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166/3 "2017-05-19T18:12:42Z")

</div>

Hey @andrewkroh, I tried that, it doesn't seem to work for me. It only runs if I check off "Install Ncap in WinPcap API-Compatible mode" in the Npcap GUI installer, or install via the commandline with:  
`npcap-0.86.exe /S /winpcap_mode=yes`

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 19, 2017, 7:20pm UTC](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166/4 "2017-05-19T19:20:41Z")

</div>

Good to know about the `winpcap_mode=yes`. Thanks

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 19, 2017, 7:24pm UTC](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166/5 "2017-05-19T19:24:14Z")

</div>

I opened an issue to add this info to the docs. [https://github.com/elastic/beats/issues/4364](https://github.com/elastic/beats/issues/4364)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 16, 2017, 7:24pm UTC](https://discuss.elastic.co/t/can-packetbeat-be-configured-to-use-npcap-by-default/86166/6 "2017-06-16T19:24:14Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.