Under Windows NT and Windows 2000 there are problems with the binding process, that prevents a protocol driver from working properly on the WAN adapter if it is not written by Microsoft. WinDump is the porting of tcpdump. Old versions have lower capture performance. For example Windump B 5000 starts WinDump with a 5 megabytes driver s buffer. When not specified, the dimension of the buffer is 1 megabyte.
Bigger sizes mean better capture performance.
Remember, however, that WinDump is a software network analyzer and needs a fast hardware if used on fast networks. WinDump can run on all the operating systems supported by WinPcap, i.e. Windows 95,98,ME, NT4 and 2000. WinPcap was developed to work primarily with Ethernet adapters. Support for other MACs was added during the development, but Ethernet remains the preferred one. The main reason is that all our development stations have Ethernet adapters so all our tests were made on this type of network.