# Packetbeat npac version and Defender for Identity **URL:** \ **Category:** Beats\ **Tags:** packetbeat\ **Created:** [January 16, 2023, 8:27am UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230 "2023-01-16T08:27:25Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![jaegerschnitzel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaegerschnitzel/32/115959_2.png) [@jaegerschnitzel](https://discuss.elastic.co/u/jaegerschnitzel)\ **Post date:** [January 16, 2023, 8:27am UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/1 "2023-01-16T08:27:25Z")
Hi all, we are using Packetbeat for capturing DNS traffic from some of our Windows servers. Defender for Identity is also installed on these servers. ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/c/1/c1e6092c9cafe85cbc0af5dca07bf7f8884eb567.png) Defender for Identity uses npcap OEM 1.00. Packetbeat somehow updates npcap version to latest 1.71 and that's why the message occurs. Is it somehow possible to disable the autoupdate or force Packetbeat to use the already installed npacp OEM 1.00 version? Thanks for your help. ---
**Author:** ![mazoutte](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mazoutte/32/120188_2.png) [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Post date:** [January 16, 2023, 3:22pm UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/2 "2023-01-16T15:22:04Z")
Hello, I'm using same configuration, and packetbeat works perfectly with the OEM version included with the MDI Sensor. I'm not aware that Packetbeat includes as well a PCAP library ... I'm using however the ZIP archive, not the MSI... I never used the MSI, so I can't figure if the pcap lib is included with the MSI package. Edit : I experienced as well the same error you mentioned when updating manually the npcap to an another version. It appears every time you update/downgrade the npcap lib. Check your package of Packetbeat to see if the MSI is providing the npcap - or have a try with the ZIP. ---
**Author:** ![jaegerschnitzel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaegerschnitzel/32/115959_2.png) [@jaegerschnitzel](https://discuss.elastic.co/u/jaegerschnitzel)\ **Post date:** [January 17, 2023, 7:18am UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/3 "2023-01-17T07:18:37Z")
Thanks for your reply. According to the docs npcap is always included in Packetbeat for Windows: > You probably do not need to install libpcap. The default distribution of Packetbeat for Windows comes bundled with the Npcap library. According to [this Github](https://github.com/elastic/integrations/issues/2132) post the installation should be optional. But I couldn't figure out how to set this. ---
**Author:** ![jaegerschnitzel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaegerschnitzel/32/115959_2.png) [@jaegerschnitzel](https://discuss.elastic.co/u/jaegerschnitzel)\ **Post date:** [January 26, 2023, 7:55am UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/4 "2023-01-26T07:55:35Z")
I think this is the cause of the mentioned behaviour: [packetbeat/beater: don't attempt to install npcap when already installed by efd6 路 Pull Request #30509 路 elastic/beats 路 GitHub](https://github.com/elastic/beats/pull/30509#issuecomment-1047299866) Also I saw that the optional setting to prevent npcap installation has been removed. Can somebody confirm that? ---
**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\ **Post date:** [January 26, 2023, 10:03am UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/5 "2023-01-26T10:03:55Z")
Hi @jaegerschnitzel, When we initially started bundling npcap with Packetbeat we didn't include an option to prevent npcap installation. This is actually the first time we're seeing an issue with another product bundling npcap too, so thanks for raising it. We can certainly look at adding an option to Packetbeat, but I'm curious if our version of npcap is actually causing issues with Defender for Identity, or is it just throwing a warning message? I noticed the MS docs state "_The recommended and officially supported version of Npcap is version 1.0. You can install a newer version of Npcap, but note that for troubleshooting, support will ask you to downgrade the Npcap version to validate that the issue is not related to the newer version installed_." Npcap 1.0 is over 2 years old, whereas we stay inline with npcap versions. cc @kortschak for visibility. ---
**Author:** ![jaegerschnitzel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaegerschnitzel/32/115959_2.png) [@jaegerschnitzel](https://discuss.elastic.co/u/jaegerschnitzel)\ **Post date:** [January 30, 2023, 3:24pm UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/6 "2023-01-30T15:24:52Z")
Hi @jamie.hynds , thanks for your reply 馃榾 As far as we can see there is no problem with Defender for Identity and the latest npcap version. But the monitoring and health services shows that Defender for Identity is not working properly due to that version mismatch. This behaviour is really annoying and affects our daily business. So it would be great if you could include an option to disable the automatic update process. Of course I know that version 1.0 is really old and will raise also a feature request to Microsoft. But we both know that this could take forever... ---
**Author:** ![jamie.hynds](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamie.hynds/32/84205_2.png) [@jamie.hynds](https://discuss.elastic.co/u/jamie.hynds)\ **Post date:** [January 30, 2023, 3:50pm UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/7 "2023-01-30T15:50:33Z")
> [@jaegerschnitzel](#): > > packetbeat/beater: don't attempt to install npcap when already installed by efd6 路 Pull Request #30509 路 elastic/beats 路 GitHub Got it. Thanks for the additional insight @jaegerschnitzel I've created an issue here where we'll discuss some options: [[Packetbeat] Disable install/auto-update of npcap 路 Issue #34420 路 elastic/beats 路 GitHub](https://github.com/elastic/beats/issues/34420) ---
**Author:** ![efd6](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/efd6/32/94818_2.png) [@efd6](https://discuss.elastic.co/u/efd6)\ **Post date:** [February 6, 2023, 3:01am UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/8 "2023-02-06T03:01:30Z")
@jaegerschnitzel The [change](https://github.com/elastic/beats/pull/34428) allowing users to block installation of the bundled Npcap library is merged in main and will be available in 8.7 when that is released. Caveats around the use of this option obviously exist since we may make use of functionality that does not exist in the already installed version of Npcap; as far as I know this is not currently the case. If issues arise in packetbeat with the install block turned on, it will be necessary to demonstrate that the issue is also present with the bundled version of the library installed. ---
**Author:** ![jaegerschnitzel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaegerschnitzel/32/115959_2.png) [@jaegerschnitzel](https://discuss.elastic.co/u/jaegerschnitzel)\ **Post date:** [February 7, 2023, 6:42pm UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/9 "2023-02-07T18:42:28Z")
@efd6 @jamie.hynds Thank you very much for your fast implementation of this feature! Really great work 馃槂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 7, 2023, 8:42pm UTC](https://discuss.elastic.co/t/packetbeat-npac-version-and-defender-for-identity/323230/10 "2023-03-07T20:42:42Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.