Versions

4.1.0.2001	89.09%
4.1.0.1753	10.91%

rpcapd.exe has 2 known versions, the most recent one is 4.1.0.2001. It is started as a Windows Service called 'Remote Packet Capture Protocol v.0 (experimental)' with the name 'rpcapd' and described as “Allows to capture traffic on this machine from a remote machine.”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 114.52 KB. It is an authenticode code-signed executable issued to CACE Technologies by the certification authority VeriSign. The programs OpenOffice.org 3.1, WinPcap 4.1.1 and Spotnet Launcher have been observed as installing specific variations of rpcapd.exe. During the process's lifecycle, the typical CPU resource utilization is about 0.0001% including both foreground and background operations, the average private memory consumption is about 2.28 MB with the maximum memory reaching around 4.72 MB. Addionally, typically read and write I/O disk operations is about 8 Bytes per minute for reads and 0 Bytes per minute for writes.

WinPcap allows applications to capture and transmit network packets and consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. WinPcap comes with Remote Capture capabilities.This requires a remote daemon (called rpcapd) which performs the capture and sends data back and a local client that sends the appropriate commands and receives the captured data.