How it Works

It is a "tcpdump" executable, WinPcap library and driver wrapped in a simple executable that:

1. Unpacks the files to a temporary directory;
2. Installs and starts the "npf" driver (from WinPcap);
3. Runs tcpdump.exe; and
4. Cleans up everything