Troubleshooting WinPcap and NPcap Conflicts on Tencent Cloud Machines with Wireshark

Some Tencent Cloud machines have WinAgent, which comes with WinPcap. If you install a higher version of Wireshark (≥3.0, where the network card filter is not WinPcap but NPcap), you may encounter a situation where both Pcap versions (WinPcap and NPcap) coexist, causing Wireshark packet capture anomalies such as TCP retransmissions occurring within a 20-microsecond interval, as shown in the image below.

Tencent Cloud

Although this does not directly impact business operations, it can affect packet capture analysis, causing inconvenience.

Preliminary Plan:

Tencent Cloud Related Issues

Error installing winpcap on some images with Tencent WinAgent.

Solution

Due to Tencent WinAgent including WinPcap, standalone installation of WinPcap is not possible.

[Tencent WinAgent Service]

C:\Program Files (x86)\WinAgent\

service name: winagent

display name: Tencent WinAgent

Tencent Cloud

Version 4.1.3: The last official WinPcap release was 4.1.3

Winpcap 4.1.3 is compatible with win7/win8.1/win10/2016/2019/2022/2012R2/2008R2

Wireshark version 2.6.20 is recommended (the last Wireshark version with WinPcap; newer versions are with NPcap)

Wireshark full version download link: https://2.na.dl.wireshark.org/win64/all-versions/

Search for version 2.6 and find the latest, which is currently 2.6.20

Run these 3 command lines in the command prompt as an administrator before installing WinPcap

Original Statement: This article is authorized by the author to be published on the Tencent Cloud Developer Community. Republishing without permission is prohibited.

If there is any infringement, please contact for removal.