Now Npcap can have a send-to-Rx adapter. The send-to-Rx adapter will inject all its packets to "Receive Path" (Rx)
instead of normal "Send Path" (Tx)
. So that instead of sending traffic to the network, the adapter will pretend to receive the injected traffic from the network in this way.
Currently only one send-to-Rx adapter is supported by specifying SendToRx
value in Npcap driver service's registry key (need to restart the driver to take effect).
Npcap driver service's registry key is usually in: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npf
. In this key. You need to manually create a REG_SZ
value named SendToRx
, the value is the name of the adapter you want to be send-to-Rx adapter. The name is usually like format of \Device\{F5A00000-E19A-4D17-B6D9-A23FE1852573}
. You can query this value using Nmap's nmap --iflist
command, you will get a similar value like \Device\NPF_{F5A00000-E19A-4D17-B6D9-A23FE1852573}
, but they are NOT THE SAME. You need to remove the NPF_
in this string and copy it to registry's SendToRx
value. Then reboot the driver by net stop npf
and net start npf
.