Win10Pcap is provided as a Windows Installer module (.msi package).


Win10Pcap Update Information

  • Win10Pcap 10.2.5002 (October 8, 2015)
    Added the security check code on the read/write/ioctl procedures on the Win10Pcap kernel-mode driver. In the previous version of Win10Pcap, the kernel-mode driver did not check the virtual addresses which are passed from the user-mode. A local user was able to exploit this to read or write data bytes in the kernel-space memory. This had a risk to allow a local user to gain the escalated privilege on the local system. This security check code is to prevent such as illegal access from a local user. For details, please see
    The problem was reported by Meysam Firozi on October 7, 2015. I greatly appreciate Meysam Firozi's contribution to report this problem.
  • Win10Pcap 10.2.5001 (June 10, 2015)
    Initial release.



You can use the original version of Wireshark with Win10Pcap.


See also


Compatible with Windows 10 on both x86 and x64 platforms.