-wifi version Npcap is especially for the people who want to capture packets with 802.11 headers instead of Ethernet headers on their wireless adapters.
Other users who do NOT care about this feature should use a
normal version Npcap. The latest
normal version Npcap is
0.06 r14 at:
WlanHelper.exewith Administrator privilege. Type in the index of your wireless adapter (usually
0) and press
Enter. Then type in
Enterto to switch on the Monitor Mode.
Wiresharkand capture on the wireless adapter, you will see all 802.11 packets (data + control + management).
- If you need to return to Managed Mode, run
WlanHelper.exeagain and input the index of the adapter, then type in
Enterto to switch off the Monitor Mode.
You need to use
WlanHelper.exe tool to switch on the Monitor Mode in order to see
802.11 control and management packets in Wireshark (also
encrypted 802.11 data packets, you need to specify the
decipher key in Wireshark in order to decrypt those packets), otherwise you will only see
802.11 data packets.
Switching on the Monitor Mode will disconnect your wireless network from the AP, you can switch back to Managed Mode using the same
The source code of
WlanHelper.exe tool is published at:
Managed Mode (for
Linux) = Extensible Station Mode (aka ExtSTA, for
Monitor Mode (for
Linux) = Network Monitor Mode (aka NetMon, for