Wpcap.dll is missing on Windows 11

[Br41nfck]

What happened?

Error message box "wpcap.dll was not found"

What did you expect?

Start program as usual.

Steps to reproduce:

1. Download and run a program without additional software

Environment:

• OS: Windows 11 Pro 25H2 (Build 26200)
• NetWatch version (netwatch --version): 0.29.0
• Terminal: Windows Terminal (1.24.11911.0)

How to fix?

1. Install npcap.exe from offical site - https://npcap.com/#download for Windows

[matthart1983]

Thanks for the report, and for including the fix — you're right on both counts. NetWatch links against Npcap's wpcap.dll on Windows, and installing Npcap from https://npcap.com/#download resolves it.

This is a documentation bug on my side rather than a code one. The README lists libpcap under prerequisites but never states the Npcap requirement for Windows, and the platform download table doesn't list the Windows binary at all — even though it's one of the most-downloaded assets of each release. Fixing both.

On the error dialog itself: wpcap.dll is a load-time import in the MSVC build, so the process dies before main() runs and NetWatch never gets the chance to print anything useful — hence the bare Windows message box instead of a real error. Turning that into a readable "Npcap not installed" message requires delay-loading the DLL so the failure can be caught. I'll track that separately; docs first.

Leaving this open until the README change lands.

[gacragg-github]

Even with npcap 1.88 installed (current as of today), I still get this error. To resolve, I re-installed npcap and selected the option:

Install Npcap in WinPcap API-compatible Mode

[matthart1983]

Fixed in v0.29.2, just released.

@gacragg-github your comment was the root cause, and my earlier reply was wrong. Npcap 1.x installs wpcap.dll into %SystemRoot%\System32\Npcap\ rather than System32, so it can coexist with WinPcap — and that subdirectory isn't on the loader's default search path. Install Npcap in WinPcap API-compatible Mode also copies the DLLs into System32, which is why reinstalling with it ticked worked for you. It's off by default, so "install Npcap and run NetWatch" was a procedure that failed for anyone accepting the installer's defaults. Not an edge case — the normal path.

What changed:

• wpcap.dll is now delay-loaded, so nothing resolves it before main() runs and NetWatch gets a turn to speak.
• At startup NetWatch asks Windows for its system directory, adds System32\Npcap to the DLL search path, and loads wpcap.dll itself — the approach Wireshark and nmap use for this same layout. Asking rather than hardcoding the path also gets the bitness right: WOW64 redirects a 32-bit process to SysWOW64, where the DLLs it can actually load live.
• With no Npcap at all you now get a message naming what to install and where to get it, plus the directory searched, instead of a bare loader dialog.
• --version and --help answer on a machine without Npcap. They used to die with the rest of the process, which is unhelpful for the one command people run when filing this.

So on v0.29.2 a stock Npcap install should work with no checkbox: https://github.com/matthart1983/netwatch/releases/download/v0.29.2/netwatch-windows-x86_64.exe.zip

Leaving this open until someone confirms it on a real machine. I don't have a Windows box — CI builds and links the delay-load path on windows-latest and the tests pass there, but the runner has no Npcap installed, so the part that actually matters (loading the DLL out of System32\Npcap) is unverified. If either of you gets a chance: a stock Npcap install, no compatibility mode, v0.29.2, and tell me whether it starts. A report that it still fails is just as useful as one that it works.

Thanks to you both — @Br41nfck for the original report and the fix that got Windows users unblocked in the meantime, and @gacragg-github for catching that the fix was incomplete.