Home How it works Support Boost Connect Download

Boost Connect

Uncovering the DNA of programs.
Good programs    
Fair programs  
Bad programs 

What is rpcapd.exe?

Part of WinPcap by CACE Technologies

What is it?

WinPcap allows applications to capture and transmit network packets and consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. WinPcap comes with Remote Capture capabilities.This requires a remote daemon (called rpcapd) which performs the capture and sends data back and a local client that sends the appropriate commands and receives the captured data.
Description of rpcapd.exe from CACE Technologies
WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture. WinPcap consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. This library also contains the Windows version of the well known libpcap Unix API. WinPcap extends the standard WinPcap code in such a way that all WinPcap-based tools can expoit remote capture capabilities. For instance, the capabillity to interact with a remote daemon are added to the client software without any explicit modification to it. Vice versa, the remote daemon must be explicitely installed (and configured) on the remote machine.
Download Boost and enjoy your PC. Speed up WinPcap and optimize your PC.

How does rpcapd.exe run?

Service - rpcapd.exe runs as a background Windows service called 'rpcapd' (Remote Packet Capture Protocol v.0 (experimental)). This service runs as the SYSTEM account with extensive privileges on the local computer, and acts as the computer on the network. Remote Packet Capture Protocol v.0 (experimental) runs as a program that can be started by the Service Controller and that obeys the service control protocol. This type of service runs in a process by itself.


What is the community is seeing?What is the community is doing?
About 0.1% of all Boost users have the rpcapd.exe process running.Of the 0.1% of rpcapd.exe users, 12.0% have disabled it.
How resource intensive is rpcapd.exe?
Comparison based on the average resource utilization across all programs.
0.00009% CPU937.8%
Average CPU utilization across all programs is 0.00001%.
          2.28 MB RAM10.6%
Average private memory utilization across all programs is 21.53 MB.
 2 /min0.1%
Average I/O read and write operations for all programs is 2,253 per minute.
Typical file (disk image) location:
C:\Program Files\winpcap\rpcapd.exe

Are there other versions of WinPcap?

What modules are loaded?

A module is a dynamic link library (DLL) or an executable file that is loaded into the process. Below is a list of non-system modules that are loaded by WinPcap.

What else is related?

What Windows OS versions does this run on?

Microsoft Windows XP (5.1.2600.131072)
Microsoft Windows XP (5.1.2600.196608)
Windows Vista (TM) Home Premium (6.0.6002.131072)
Windows Vista (TM) Home Premium (6.0.6002.131072)
Microsoft Windows 7 Ultimate (6.1.7600.0)
Windows 7 Ultimate (6.1.7600.0)
Windows 7 Ultimate (6.1.7600.0)
Windows 7 Home Premium (6.1.7601.65536)
Windows 7 Professional (6.1.7601.65536)
Windows 7 Ultimate (6.1.7601.65536)
Windows Seven Black Edition (6.1.7601.65536)
Windows 7 Home Premium (6.1.7601.65536)
Download Boost

File details

File name: rpcapd.exe
Publisher: CACE Technologies, Inc. (verified)
Name: WinPcap
Description: Remote Packet Capture Daemon
Size: 114.52 KB
Original file name: rpcapd.exe

Digital certificate

Certificate authority: VeriSign
Effective date: 5/6/2008
Expiration date: 5/7/2011

Resource utilization

CPU utilization averages
Total CPU: 0.0000937849%
Privileged CPU: 0%
User CPU: 0.00009378494356%
CPU cycle count: 139,915,830
CPU cycle count /min: 299,113
Memory utilization averages
Committed memory: 44.51 MB
Peak committed memory: 49.77 MB
Paged memory: 2.28 MB
Peak paged memory: 2.46 MB
Paged system memory: 73.31 KB
Non-paged system memory: 8.85 KB
Working set memory: 3.74 MB
Peak working set memory: 5.35 MB
Min working set memory: 3.74 MB
Private memory: 2.28 MB
Page faults: 1,681
Page faults /min: 4
Process I/O averages
Total read operations: 5
Read operations /min: 1
Total read transfer: 3.62 KB
Read transfer /min: 8 Bytes
Total write operations: 4
Write operations /min: 1
Total write transfer: 260 Bytes
Write transfer /min: 0 Bytes
Total other operations: 710
Other operations /min: 2
Total other transfer: 2.9 KB
Other Transfer /min: 6 Bytes
Handle count average: 89
Thread count average: 6
Thread resource averages

Process details

Runs as (owner): System
Integrety level: System
Windows platform: 32-bit
Runs as a service: Yes
Parent Process
Process Command
"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"

Service details

Name: Remote Packet Capture Protocol v.0 (experimental)
Service name: rpcapd
Service type: Win32OwnProcess
Description: “Allows to capture traffic on this machine from a remote machine.”

Network connectivity

TCP: localhost on port 2002

Image hashes

MD5: b60f58f175de20a6739194e85b035178
SHA-1: 1568c3bb5a8e7fd530ac1996a137fd22e117a707
SHA-256: 6e66d6041af0b69896e4556f9ff3a3aa70cf4b09ffbe68e14e60313c5e3ffddb

PE image details

File entropy: 6.23887
File packed: No
Import Table
Stay up to date with news about Boost
Subscribe to our newsletter to receive the latest Boost news and discounts.
© 2018 Reason Software Company Inc.
228 Park Ave S #74122 New York, NY 10003
(646) 664-1038 | info@boostbyreason.com
How it works Privacy Terms Support Contact Download Donate Reason Software, the makers of Boost logo

Download Boost and enjoy your PC.

Increase your PC's performance.
Remove unwanted crapware.
Reduce your boot time.
Identify and resolves crashes.
Download the FREE unlimited trial of Boost!
No spyware, no adware, no bundles, no tricks.

Save 40% on Boost

For a limited time, from now until Sunday, June 24, 2018 you can purchase Boost for 40% off of the normal price, only $39.95 $24.95.
The instant online savings will be automatically applied during checkout.

100% Satisfaction Guarantee

Purchase with confidence. We stand behind Boost.
If for any reason you are not satisfied with your software purchase, simply contact our Customer Support within 30 days, and we'll refund the purchase price. We won't make you jump through hoops to get all your money back!