Installing a Packet Capture Library on Windows

The typical installation package of Qosium does not contain a packet capturing library. If a such library has not been installed in the system earlier, it has to be installed manually. There is also some parameterization to consider.

In Windows, there are at least three supported alternatives for packet capturing, which are discussed in the following sections.

1. WinPcap #

WinPcap (version 4.1.3) is one option for Qosium. Despite the fact that it has not been updated for years, and uses the nowadays deprecated NDIS 5.x, it still works with most of the system configurations even in the newest versions of Windows 10. NDIS (Network Driver Interface Specification) is the API for NICs used by Windows-based systems. Thus, if your NIC works with WinPcap, there is no imminent reason to stop using it.

Download WinPcap

2. Npcap #

Npcap is a newer packet capturing library, which is based on WinPcap. Unlike WinPcap, it is under continuous development. Npcap uses NDIS 6.x, so it should support also those NIC’s that WinPcap no longer does. Please bear in mind that unlike with WinPcap, Npcap’s free use is not unlimited. Thus, please check the license conditions of Npcap if you are considering using it.

Download Npcap

If you choose Npcap, install it to WinPcap-compatible form. In this way Qosium can use it directly. See below what needs to be checked in the installation wizard. The other options shown in the figure are up to the needs – they are neither limited nor required by Qosium.

If you need to make modifications to the driver’s parameters, restart the driver, e.g., from the command prompt (with superuser rights) to enable the changes.

To shut down:

net stop npcap

To start:

net start npcap

3. Win10Pcap #

Yet another alternative for a packet capturing driver for Windows is Win10Pcap. Like Npcap, this is also based on WinPcap but has the support for the NDIS 6.x driver model. Win10Pcap works directly with Qosium. Win10Pcap is fully free to use since it is under the GPLv2 license. It is, however, not known that is the driver any longer developed. At least, it does not look promising, since the newest version is from Oct. 8, 2015 (as of February 2021). In any case, it is still newer than the original WinPcap and seems to work.

One technical downside is that it is not confirmed whether the different timestamp modes are supported or not in Win10Pcap. At least, with tests carried out, we haven’t yet been successful in modifying the timestamp mode.

Download Win10Pcap

4. Parameterization: Timestamping Mode #

Npcap and WinPcap support several timestamp modes. With the default mode 0, the absolute accuracy is “a one-shot accuracy”, since system performance counters are used for providing high timestamp resolution, but the absolute time is not synchronized. This means that once the driver is turned on, the absolute time is once got from the system clock, but after this, system performance counters will be used for updating the time. Hence, the absolute time begins to drift, and the accuracy of Qosium’s delay measurement gets worse as a function of measurement time. However, the resolution is high – even better than in Linux – leading to highly accurate jitter calculation.

If you are interested in one-way delay measurements, it is recommended to change the timestamp mode. One option supported by all known versions of Npcap and WinPcap is 2, in which case, the system clock is used for timestamping packets. This relieves the one-shot accuracy problem but has a downside that it makes the accuracy of jitter calculation worse. This is thanks to the Windows’ system clock resolution that is typically only 1 ms. In fact, the default Windows’ system clock resolution is as bad as 15.6 ms, but when Qosium is in use, it increases the resolution to 1 ms. For most of the practical applications this 1 ms resolution is already enough, but of course, it is very far from the µs-level resolution that can be reached with timestamp mode 0.

The newer versions of Npcap support also timestamp mode 4. In this, the system clock is used for absolute timing, but system performance counters are used to calculate the accurate time between the sparse clock ticks. If you can use a new Npcap, this is the recommended mode, since it provides highly accurate timestamps without losing the absolute timing synchronization.

If you allow, Qosium’s installation wizard detects automatically the installed Pcap version and selects timestamp mode 4 when available and mode 2 otherwise. If not, here are the instructions on how to do it manually. The timestamping mode can be changed in the registry. Prior to this, the packet capturing driver must be stopped.

1. Stop the measurement first (and all SW using Pcap, such as Wireshark in addition to Qosium)
2. Open the command prompt and stop the packet capturing driver as explained earlier in the context of Npcap
3. Open Registry Editor and navigate to
   WinPcap: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF
   Npcap (below 0.9985): HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npf\Parameters
   Npcap (version 0.9985 and higher): HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\npcap\Parameters
4. Locate the parameter TimestampMode. If it does not exist, create it (REG_DWORD).
5. Change/set the mode to the desired value
6. Start the packet capturing driver