Looks like the problem was introduced in 0.99-r8. I upgrading from WinPcap to Npcap 0.99-r7, and everything worked as expected.

Test these configurations, and the problem affects them all:

1. Windows 10 Home, v1803
2. Windows 10 Pro, v1803
3. Windows 10 Enterprise, v1703

If you uncheck "Install Npcap in WinPcap API-compatible Mode", then you don't see the issue. But, having that checked is the default, so most users will experience this problem when upgrading.

More notes:

1. Going from WinPcap to 0.99-r7, then 0.99-r7 to 0.99-r9 doesn't trigger the issue. Going directly from WinPcap to 0.99-r9 does trigger the issue.
2. Attached install log files.
   install.log
   NPFInstall.log

The first error is that it can't write a file inside C:\Program Files\Npcap. It looks like Npcap doesn't create the folder first, before it tries to create the file, when installing from WinPcap to Npcap. It seems to work fine if you install Npcap without WinPcap previously installed.

When upgrading from WinPcap to Npcap:

• If I manually create the C:\Program Files\Npcap folder before installing Npcap, it works.
• If C:\Program Files\Npcap does not exist before installing Npcap, it fails.

This is an issue for Wireshark, because Wireshark 2.x uses WinPcap by default, the upcoming Wireshark 3.0 will install Npcap by default. So, most Windows 10 users would encounter this issue when upgrading (unless Wireshark packages an Npcap installer with the fix)

Note: I have not tested on Windows 7

Thanks for the detailed error report. I think I know why this is happening: we added some code to the installer to kill processes using WinPcap before running the WinPcap uninstaller, but as you noted, it needs to write and run the NPFInstall2.exe executable to do so. I think that at the point where the code was inserted, the Npcap install has not started, so the installation directory potentially doesn't exist. I'll change this to either extract NPFInstall2.exe to a random temp directory first or ensure that the installation directory is created first.

Hi Dan,

Any chance to release a 0.99-r10 soon? We are about to release Wireshark 3.0 release candidate and I would like to package this version if possible.