@kar-mi/spirit-vale-tools-capture 2.4.2 → 2.5.1

package/dist/capture/adapter-selection.d.ts

@@ -5,5 +5,5 @@ export interface AdapterResolution {
     detail?: string;
 }
 export declare function resolveCaptureDevice(devices: readonly NpcapDevice[], requestedName?: string): Promise<AdapterResolution>;
-export declare function chooseDeviceByRouteOutput(devices: readonly NpcapDevice[], output: string): NpcapDevice | undefined;
+export declare function chooseDeviceByRouteAddress(devices: readonly NpcapDevice[], address: string): NpcapDevice | undefined;
 //# sourceMappingURL=adapter-selection.d.ts.map

package/dist/capture/adapter-selection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter-selection.d.ts","sourceRoot":"","sources":["../../src/capture/adapter-selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAYlH"}
+{"version":3,"file":"adapter-selection.d.ts","sourceRoot":"","sources":["../../src/capture/adapter-selection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAa5B;AAED,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,SAAS,WAAW,EAAE,EAC/B,OAAO,EAAE,MAAM,GACd,WAAW,GAAG,SAAS,CAEzB"}

package/dist/capture/npcap.d.ts

@@ -1,4 +1,4 @@
-export type NpcapAvailability = "ready" | "missing" | "admin-only" | "error";
+export type NpcapAvailability = "ready" | "missing" | "error";
 export interface NpcapStatus {
     availability: NpcapAvailability;
     detail: string;
@@ -32,6 +32,7 @@ export declare class SystemNpcapRuntime implements NpcapRuntime {
     private readyStatus?;
     status(): Promise<NpcapStatus>;
     listDevices(): Promise<NpcapDevice[]>;
+    private enumerateDevices;
     open(device: NpcapDevice, filter: string): Promise<NpcapSession>;
     private load;
 }

package/dist/capture/npcap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npcap.d.ts","sourceRoot":"","sources":["../../src/capture/npcap.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,GAAG,OAAO,CAAC;AAE7E,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,iBAAiB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,UAAU,IAAI,WAAW,GAAG,SAAS,CAAC;IACtC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/B,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAClE;AAID,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,GAAG,CAAC,CAAc;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAc;IAE5B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CA0BnC;IAEK,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAiC1C;IAEK,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAiCrE;IAED,OAAO,CAAC,IAAI;CAyBb"}
+{"version":3,"file":"npcap.d.ts","sourceRoot":"","sources":["../../src/capture/npcap.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,CAAC;AAE9D,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,iBAAiB,CAAC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,IAAI,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,UAAU,IAAI,WAAW,GAAG,SAAS,CAAC;IACtC,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/B,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAClE;AAKD,qBAAa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,GAAG,CAAC,CAAc;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAc;IAE5B,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,CA4BnC;IAEK,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAI1C;IAED,OAAO,CAAC,gBAAgB;IAgClB,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAsCrE;IAED,OAAO,CAAC,IAAI;CAyBb"}

package/dist/capture/packet-capture.d.ts

@@ -24,6 +24,8 @@ export declare class PacketCapture extends EventEmitter {
     private decodeFishNet;
     private fishNetRpcMap;
     private fishNetSessionDecoder;
+    private droppedPending;
+    private droppedReportedAtMs;
     private _state;
     constructor(dependencies?: PacketCaptureDependencies);
     get state(): CaptureState;
@@ -41,6 +43,8 @@ export declare class PacketCapture extends EventEmitter {
     stop(): Promise<void>;
     private poll;
     private flushPending;
+    /** Reports packets given up on unattributed, which is how a connection loses its opening. */
+    private reportDroppedPending;
     private emitTransportPacket;
     private emitLiteNetLibPackets;
     private emitFishNetPacket;

package/dist/capture/packet-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"packet-capture.d.ts","sourceRoot":"","sources":["../../src/capture/packet-capture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAW3C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAiB,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAgB,WAAW,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACb,MAAM,aAAa,CAAC;AAQrB,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAOD,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAE3D;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAE/D;AAED,qBAAa,aAAc,SAAQ,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAyB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,MAAM,CAAC,CAAuB;IACtC,OAAO,CAAC,SAAS,CAAC,CAAiC;IACnD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,MAAM,CAA2B;IAEzC,YAAY,YAAY,GAAE,yBAA8B,EAKvD;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAEQ,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IACjD,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,GAAG,IAAI,CAAC;IACzE,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,GAAG,IAAI,CAAC;IAC5E,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI,CAAC;IACxF,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,wBAAwB,KAAK,IAAI,GAAG,IAAI,CAAC;IACvF,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,qBAAqB,KAAK,IAAI,GAAG,IAAI,CAAC;IACpF,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,GAAG,IAAI,CAAC;IACjF,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAChE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IAC3D,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAKpD,KAAK,CAAC,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CrD;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAO1B;IAED,OAAO,CAAC,IAAI;IA0CZ,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,iBAAiB;IA4BzB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,YAAY;CAOrB"}
+{"version":3,"file":"packet-capture.d.ts","sourceRoot":"","sources":["../../src/capture/packet-capture.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAW3C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAiB,MAAM,qBAAqB,CAAC;AAChF,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAgB,WAAW,EAAE,MAAM,YAAY,CAAC;AACvF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACb,MAAM,aAAa,CAAC;AAkBrB,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,YAAY,CAAC;IACvB,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAOD,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAE3D;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAE/D;AAED,qBAAa,aAAc,SAAQ,YAAY;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAyB;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,MAAM,CAAC,CAAuB;IACtC,OAAO,CAAC,SAAS,CAAC,CAAiC;IACnD,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAA4B;IACjD,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,MAAM,CAA2B;IAEzC,YAAY,YAAY,GAAE,yBAA8B,EAKvD;IAED,IAAI,KAAK,IAAI,YAAY,CAExB;IAEQ,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IACjD,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,GAAG,IAAI,CAAC;IACzE,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,GAAG,IAAI,CAAC;IAC5E,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI,CAAC;IACxF,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,wBAAwB,KAAK,IAAI,GAAG,IAAI,CAAC;IACvF,EAAE,CAAC,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,qBAAqB,KAAK,IAAI,GAAG,IAAI,CAAC;IACpF,EAAE,CAAC,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,GAAG,IAAI,CAAC;IACjF,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAAC;IAChE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IAC3D,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAKpD,KAAK,CAAC,MAAM,GAAE,aAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CrD;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAO1B;IAED,OAAO,CAAC,IAAI;IA4CZ,OAAO,CAAC,YAAY;IAwBpB,6FAA6F;IAC7F,OAAO,CAAC,oBAAoB;IAU5B,OAAO,CAAC,mBAAmB;IAO3B,OAAO,CAAC,qBAAqB;IAa7B,OAAO,CAAC,iBAAiB;IA4BzB,OAAO,CAAC,UAAU;IAclB,OAAO,CAAC,cAAc;IAUtB,OAAO,CAAC,YAAY;CASrB"}

package/dist/capture/target-tracker.d.ts

@@ -1,10 +1,7 @@
 import type { CaptureProtocol, CapturedTransportPacket, CaptureTargetStatus } from "../types.ts";
-interface OwnedEndpoint {
-    protocol: CaptureProtocol;
-    address: string;
-    port: number;
-    processId: number;
-}
+import type { WindowsOwnedEndpoint } from "./win32-system.ts";
+type OwnedEndpoint = WindowsOwnedEndpoint;
+export declare const TARGET_REFRESH_INTERVAL_MS = 1000;
 export interface TargetSnapshotProvider {
     snapshot(processName: string, protocols: readonly CaptureProtocol[]): Promise<{
         processIds: number[];
@@ -31,7 +28,5 @@ export declare class WindowsTargetTracker {
     private matches;
     private refresh;
 }
-export declare function parseTaskList(output: string): number[];
-export declare function parseNetstat(output: string, protocol: CaptureProtocol): OwnedEndpoint[];
 export {};
 //# sourceMappingURL=target-tracker.d.ts.map

package/dist/capture/target-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"target-tracker.d.ts","sourceRoot":"","sources":["../../src/capture/target-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEjG,UAAU,aAAa;IACrB,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC;QAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,aAAa,EAAE,CAAC;KAC5B,CAAC,CAAC;CACJ;AAED,qBAAa,oBAAoB;IAS7B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAbpC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACW,WAAW,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,QAAQ,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,EAC/C,QAAQ,GAAE,sBAA4D,EACtE,SAAS,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAe,EAC/C,iBAAiB,SAA6B,EAC7D;IAEE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAED,IAAI,IAAI,IAAI,CAGX;IAED,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAM5E;IAED,OAAO,CAAC,OAAO;YAMD,OAAO;CAgCtB;AA+BD,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAKtD;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,aAAa,EAAE,CAQvF"}
+{"version":3,"file":"target-tracker.d.ts","sourceRoot":"","sources":["../../src/capture/target-tracker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEjG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE9D,KAAK,aAAa,GAAG,oBAAoB,CAAC;AAE1C,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAEhD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC;QAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,aAAa,EAAE,CAAC;KAC5B,CAAC,CAAC;CACJ;AAED,qBAAa,oBAAoB;IAS7B,QAAQ,CAAC,WAAW,EAAE,MAAM;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAbpC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,KAAK,CAAC,CAAiC;IAC/C,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAS;IAElC,YACW,WAAW,EAAE,MAAM,EACX,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,QAAQ,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,EAC/C,QAAQ,GAAE,sBAA4D,EACtE,SAAS,GAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAe,EAC/C,iBAAiB,SAA6B,EAC7D;IAEE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAG3B;IAED,IAAI,IAAI,IAAI,CAGX;IAED,QAAQ,CAAC,MAAM,EAAE,uBAAuB,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAM5E;IAED,OAAO,CAAC,OAAO;YAMD,OAAO;CAgCtB"}

package/dist/capture/win32-system.d.ts

@@ -0,0 +1,11 @@
+import type { CaptureProtocol } from "../types.ts";
+export interface WindowsOwnedEndpoint {
+    protocol: CaptureProtocol;
+    address: string;
+    port: number;
+    processId: number;
+}
+export declare function findProcessIdsByName(processName: string): number[];
+export declare function listOwnedEndpoints(protocols: readonly CaptureProtocol[]): WindowsOwnedEndpoint[];
+export declare function defaultRouteIpv4Address(): string | undefined;
+//# sourceMappingURL=win32-system.d.ts.map

package/dist/capture/win32-system.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"win32-system.d.ts","sourceRoot":"","sources":["../../src/capture/win32-system.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGnD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAmDD,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAsBlE;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,eAAe,EAAE,GAAG,oBAAoB,EAAE,CAIhG;AAED,wBAAgB,uBAAuB,IAAI,MAAM,GAAG,SAAS,CAe5D"}

package/dist/capture.js

@@ -15235,53 +15235,8 @@ function decodeFishNetBundle(payload, options = { reliable: false }) {
   return new FishNetSessionDecoder(options.rpcMap).decode(payload, options);
 }
 
-// src/capture/adapter-selection.ts
-async function resolveCaptureDevice(devices, requestedName) {
-  if (requestedName) {
-    const requested = devices.find((device) => device.name === requestedName);
-    if (requested)
-      return { device: requested, usedFallback: false };
-  }
-  const automatic = await defaultRouteDevice(devices) ?? devices.find(isUsable) ?? devices[0];
-  return {
-    device: automatic,
-    usedFallback: Boolean(requestedName),
-    ...requestedName && automatic ? { detail: "The saved adapter is unavailable; capture is using the automatically selected adapter" } : {}
-  };
-}
-function chooseDeviceByRouteOutput(devices, output) {
-  const routes = output.split(/\r?\n/).flatMap((line) => {
-    const columns = line.trim().split(/\s+/);
-    if (columns[0] !== "0.0.0.0" || columns[1] !== "0.0.0.0" || columns.length < 5)
-      return [];
-    const metric = Number(columns[4]);
-    return [{ address: columns[3], metric: Number.isFinite(metric) ? metric : Number.MAX_SAFE_INTEGER }];
-  }).sort((left, right) => left.metric - right.metric);
-  for (const route of routes) {
-    const match = devices.find((device) => device.addresses.includes(route.address));
-    if (match)
-      return match;
-  }
-  return;
-}
-async function defaultRouteDevice(devices) {
-  try {
-    const child = Bun.spawn({
-      cmd: ["route.exe", "PRINT", "0.0.0.0"],
-      stdout: "pipe",
-      stderr: "ignore",
-      windowsHide: true
-    });
-    const output = await new Response(child.stdout).text();
-    return await child.exited === 0 ? chooseDeviceByRouteOutput(devices, output) : undefined;
-  } catch {
-    return;
-  }
-}
-function isUsable(device) {
-  const label = `${device.name} ${device.description}`.toLowerCase();
-  return !device.loopback && device.addresses.length > 0 && !["bluetooth", "wan miniport", "vmware", "hyper-v", "zerotier"].some((value) => label.includes(value));
-}
+// src/capture/win32-system.ts
+import { dlopen, FFIType } from "bun:ffi";
 
 // src/capture/ip-address.ts
 function formatIpv6(data) {
@@ -15309,6 +15264,194 @@ function formatIpv6(data) {
   return `${before}::${after}`;
 }
 
+// src/capture/win32-system.ts
+var ERROR_SUCCESS = 0;
+var ERROR_INSUFFICIENT_BUFFER = 122;
+var TH32CS_SNAPPROCESS = 2;
+var AF_INET = 2;
+var AF_INET6 = 23;
+var TCP_TABLE_OWNER_PID_ALL = 5;
+var UDP_TABLE_OWNER_PID = 1;
+var ENDPOINT_LAYOUTS = [
+  { protocol: "tcp", family: AF_INET, rowSize: 24, addressOffset: 4, portOffset: 8, processIdOffset: 20 },
+  { protocol: "tcp", family: AF_INET6, rowSize: 56, addressOffset: 0, portOffset: 20, processIdOffset: 52 },
+  { protocol: "udp", family: AF_INET, rowSize: 12, addressOffset: 0, portOffset: 4, processIdOffset: 8 },
+  { protocol: "udp", family: AF_INET6, rowSize: 28, addressOffset: 0, portOffset: 20, processIdOffset: 24 }
+];
+var ROUTE_SIZE = 56;
+var ROUTE_INTERFACE_INDEX_OFFSET = 16;
+var ADDRESS_ROW_SIZE = 24;
+var ADDRESS_ROW_INTERFACE_INDEX_OFFSET = 4;
+var PROCESS_ENTRY_SIZE = process.arch === "ia32" ? 556 : 568;
+var PROCESS_ENTRY_ID_OFFSET = 8;
+var PROCESS_ENTRY_NAME_OFFSET = process.arch === "ia32" ? 36 : 44;
+var kernel32;
+var ipHelper;
+function findProcessIdsByName(processName) {
+  requireWindows();
+  const api = loadKernel32();
+  const snapshot = api.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+  if (snapshot === null || snapshot === -1)
+    throw new Error("Windows could not create a process snapshot");
+  const entry = new Uint8Array(PROCESS_ENTRY_SIZE);
+  const view = new DataView(entry.buffer);
+  view.setUint32(0, PROCESS_ENTRY_SIZE, true);
+  const expected = processName.toLowerCase();
+  const processIds = [];
+  try {
+    let hasEntry = api.Process32FirstW(snapshot, entry) !== 0;
+    while (hasEntry) {
+      if (decodeWideString(entry, PROCESS_ENTRY_NAME_OFFSET).toLowerCase() === expected) {
+        processIds.push(view.getUint32(PROCESS_ENTRY_ID_OFFSET, true));
+      }
+      hasEntry = api.Process32NextW(snapshot, entry) !== 0;
+    }
+  } finally {
+    api.CloseHandle(snapshot);
+  }
+  return processIds.sort((left, right) => left - right);
+}
+function listOwnedEndpoints(protocols) {
+  requireWindows();
+  const selected = new Set(protocols);
+  return ENDPOINT_LAYOUTS.filter((layout) => selected.has(layout.protocol)).flatMap(readEndpoints);
+}
+function defaultRouteIpv4Address() {
+  requireWindows();
+  const api = loadIpHelper();
+  const route = new Uint8Array(ROUTE_SIZE);
+  if (api.GetBestRoute(0, 0, route) !== ERROR_SUCCESS)
+    return;
+  const interfaceIndex = new DataView(route.buffer).getUint32(ROUTE_INTERFACE_INDEX_OFFSET, true);
+  const table = readVariableTable((buffer, size) => api.GetIpAddrTable(buffer, size, 0));
+  const view = tableView(table, ADDRESS_ROW_SIZE);
+  for (let index = 0;index < view.count; index += 1) {
+    const offset = 4 + index * ADDRESS_ROW_SIZE;
+    if (view.data.getUint32(offset + ADDRESS_ROW_INTERFACE_INDEX_OFFSET, true) === interfaceIndex) {
+      return formatIpv4(table, offset);
+    }
+  }
+  return;
+}
+function readEndpoints(layout) {
+  const api = loadIpHelper();
+  const table = readVariableTable((buffer, size) => layout.protocol === "tcp" ? api.GetExtendedTcpTable(buffer, size, 0, layout.family, TCP_TABLE_OWNER_PID_ALL, 0) : api.GetExtendedUdpTable(buffer, size, 0, layout.family, UDP_TABLE_OWNER_PID, 0));
+  const view = tableView(table, layout.rowSize);
+  const endpoints = [];
+  for (let index = 0;index < view.count; index += 1) {
+    const offset = 4 + index * layout.rowSize;
+    endpoints.push({
+      protocol: layout.protocol,
+      address: readAddress(table, offset + layout.addressOffset, layout.family),
+      port: view.data.getUint16(offset + layout.portOffset, false),
+      processId: view.data.getUint32(offset + layout.processIdOffset, true)
+    });
+  }
+  return endpoints;
+}
+function readVariableTable(call) {
+  const size = new Uint32Array(1);
+  const initialResult = call(null, size);
+  if (initialResult !== ERROR_INSUFFICIENT_BUFFER || !size[0]) {
+    throw new Error(`Windows table size query failed with error ${initialResult}`);
+  }
+  for (let attempt = 0;attempt < 3; attempt += 1) {
+    const capacity = size[0] ?? 0;
+    const buffer = new Uint8Array(capacity);
+    size[0] = buffer.byteLength;
+    const result = call(buffer, size);
+    if (result === ERROR_SUCCESS)
+      return buffer.subarray(0, size[0]);
+    if (result !== ERROR_INSUFFICIENT_BUFFER || size[0] === 0) {
+      throw new Error(`Windows table query failed with error ${result}`);
+    }
+  }
+  throw new Error("Windows table changed too frequently to read consistently");
+}
+function tableView(table, rowSize) {
+  if (table.byteLength < 4)
+    throw new Error("Windows returned a truncated table");
+  const data = new DataView(table.buffer, table.byteOffset, table.byteLength);
+  const count = data.getUint32(0, true);
+  if (4 + count * rowSize > table.byteLength)
+    throw new Error("Windows returned an invalid table size");
+  return { count, data };
+}
+function readAddress(buffer, offset, family) {
+  return family === AF_INET ? formatIpv4(buffer, offset) : formatIpv6(Buffer.from(buffer.subarray(offset, offset + 16)));
+}
+function formatIpv4(buffer, offset) {
+  return `${buffer[offset]}.${buffer[offset + 1]}.${buffer[offset + 2]}.${buffer[offset + 3]}`;
+}
+function decodeWideString(buffer, offset) {
+  let end = offset;
+  while (end + 1 < buffer.byteLength && (buffer[end] !== 0 || buffer[end + 1] !== 0))
+    end += 2;
+  return new TextDecoder("utf-16le").decode(buffer.subarray(offset, end));
+}
+function requireWindows() {
+  if (process.platform !== "win32")
+    throw new Error("Windows system APIs are unavailable on this platform");
+}
+function loadKernel32() {
+  if (kernel32)
+    return kernel32;
+  kernel32 = dlopen("kernel32.dll", {
+    CreateToolhelp32Snapshot: { args: [FFIType.u32, FFIType.u32], returns: FFIType.ptr },
+    Process32FirstW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+    Process32NextW: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
+    CloseHandle: { args: [FFIType.ptr], returns: FFIType.i32 }
+  }).symbols;
+  return kernel32;
+}
+function loadIpHelper() {
+  if (ipHelper)
+    return ipHelper;
+  ipHelper = dlopen("iphlpapi.dll", {
+    GetBestRoute: { args: [FFIType.u32, FFIType.u32, FFIType.ptr], returns: FFIType.u32 },
+    GetIpAddrTable: { args: [FFIType.ptr, FFIType.ptr, FFIType.i32], returns: FFIType.u32 },
+    GetExtendedTcpTable: {
+      args: [FFIType.ptr, FFIType.ptr, FFIType.i32, FFIType.u32, FFIType.u32, FFIType.u32],
+      returns: FFIType.u32
+    },
+    GetExtendedUdpTable: {
+      args: [FFIType.ptr, FFIType.ptr, FFIType.i32, FFIType.u32, FFIType.u32, FFIType.u32],
+      returns: FFIType.u32
+    }
+  }).symbols;
+  return ipHelper;
+}
+
+// src/capture/adapter-selection.ts
+async function resolveCaptureDevice(devices, requestedName) {
+  if (requestedName) {
+    const requested = devices.find((device) => device.name === requestedName);
+    if (requested)
+      return { device: requested, usedFallback: false };
+  }
+  const automatic = defaultRouteDevice(devices) ?? devices.find(isUsable) ?? devices[0];
+  return {
+    device: automatic,
+    usedFallback: Boolean(requestedName),
+    ...requestedName && automatic ? { detail: "The saved adapter is unavailable; capture is using the automatically selected adapter" } : {}
+  };
+}
+function chooseDeviceByRouteAddress(devices, address) {
+  return devices.find((device) => device.addresses.includes(address));
+}
+function defaultRouteDevice(devices) {
+  try {
+    const address = defaultRouteIpv4Address();
+    return address ? chooseDeviceByRouteAddress(devices, address) : undefined;
+  } catch {
+    return;
+  }
+}
+function isUsable(device) {
+  const label = `${device.name} ${device.description}`.toLowerCase();
+  return !device.loopback && device.addresses.length > 0 && !["bluetooth", "wan miniport", "vmware", "hyper-v", "zerotier"].some((value) => label.includes(value));
+}
+
 // src/capture/link-layer.ts
 var DATA_LINK = {
   NULL: 0,
@@ -15352,8 +15495,9 @@ function ipVersion(data) {
 // src/capture/npcap.ts
 import { existsSync } from "fs";
 import path from "path";
-import { CString, dlopen, FFIType, read, toArrayBuffer } from "bun:ffi";
+import { CString, dlopen as dlopen2, FFIType as FFIType2, read, toArrayBuffer } from "bun:ffi";
 var ERROR_BUFFER_SIZE = 512;
+var PCAP_ERROR_PERM_DENIED = -8;
 
 class SystemNpcapRuntime {
   api;
@@ -15368,18 +15512,20 @@ class SystemNpcapRuntime {
     if (!existsSync(dllPath)) {
       return { availability: "missing", detail: "Npcap is not installed" };
     }
-    if (await isAdminOnlyInstall()) {
-      return {
-        availability: "admin-only",
-        detail: "Npcap is installed for administrators only; reinstall it with that restriction unchecked"
-      };
-    }
     try {
       const api = this.load();
       const version = String(api.symbols.pcap_lib_version());
       if (!version.toLowerCase().includes("npcap")) {
         return { availability: "error", detail: "The loaded packet capture library is not Npcap" };
       }
+      const devices = this.enumerateDevices(api);
+      if (devices.length === 0) {
+        return {
+          availability: "error",
+          detail: "Npcap reported no captureable network adapters; access may require elevation",
+          version
+        };
+      }
       this.readyStatus = { availability: "ready", detail: "Npcap is ready", version };
       return this.readyStatus;
     } catch (error) {
@@ -15390,7 +15536,9 @@ class SystemNpcapRuntime {
     const status = await this.status();
     if (status.availability !== "ready")
       throw new Error(status.detail);
-    const api = this.load();
+    return this.enumerateDevices(this.load());
+  }
+  enumerateDevices(api) {
     const resultPointer = new Uint8Array(8);
     const errorBuffer = new Uint8Array(ERROR_BUFFER_SIZE);
     const result = api.symbols.pcap_findalldevs(resultPointer, errorBuffer);
@@ -15440,6 +15588,9 @@ class SystemNpcapRuntime {
       check(api.symbols.pcap_set_buffer_size(handle, 10 * 1024 * 1024), handle, api, "set capture buffer size");
       check(api.symbols.pcap_set_immediate_mode(handle, 1), handle, api, "enable immediate mode");
       const activated = api.symbols.pcap_activate(handle);
+      if (activated === PCAP_ERROR_PERM_DENIED) {
+        throw new Error(`Npcap denied access to ${device.description}; run elevated or reinstall Npcap without administrator-only access: ${pcapError(api, handle)}`);
+      }
       if (activated < 0)
         throw new Error(`Npcap could not activate ${device.description}: ${pcapError(api, handle)}`);
       const dataLink = api.symbols.pcap_datalink(handle);
@@ -15463,25 +15614,25 @@ class SystemNpcapRuntime {
   load() {
     if (this.api)
       return this.api;
-    const library = dlopen(npcapDllPath(), {
-      pcap_lib_version: { args: [], returns: FFIType.cstring },
-      pcap_findalldevs: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-      pcap_freealldevs: { args: [FFIType.ptr], returns: FFIType.void },
-      pcap_create: { args: [FFIType.cstring, FFIType.ptr], returns: FFIType.ptr },
-      pcap_set_snaplen: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_set_promisc: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_set_timeout: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_set_buffer_size: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_set_immediate_mode: { args: [FFIType.ptr, FFIType.i32], returns: FFIType.i32 },
-      pcap_activate: { args: [FFIType.ptr], returns: FFIType.i32 },
-      pcap_datalink: { args: [FFIType.ptr], returns: FFIType.i32 },
-      pcap_compile: { args: [FFIType.ptr, FFIType.ptr, FFIType.cstring, FFIType.i32, FFIType.u32], returns: FFIType.i32 },
-      pcap_setfilter: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-      pcap_freecode: { args: [FFIType.ptr], returns: FFIType.void },
-      pcap_setnonblock: { args: [FFIType.ptr, FFIType.i32, FFIType.ptr], returns: FFIType.i32 },
-      pcap_next_ex: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.i32 },
-      pcap_geterr: { args: [FFIType.ptr], returns: FFIType.cstring },
-      pcap_close: { args: [FFIType.ptr], returns: FFIType.void }
+    const library = dlopen2(npcapDllPath(), {
+      pcap_lib_version: { args: [], returns: FFIType2.cstring },
+      pcap_findalldevs: { args: [FFIType2.ptr, FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_freealldevs: { args: [FFIType2.ptr], returns: FFIType2.void },
+      pcap_create: { args: [FFIType2.cstring, FFIType2.ptr], returns: FFIType2.ptr },
+      pcap_set_snaplen: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_set_promisc: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_set_timeout: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_set_buffer_size: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_set_immediate_mode: { args: [FFIType2.ptr, FFIType2.i32], returns: FFIType2.i32 },
+      pcap_activate: { args: [FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_datalink: { args: [FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_compile: { args: [FFIType2.ptr, FFIType2.ptr, FFIType2.cstring, FFIType2.i32, FFIType2.u32], returns: FFIType2.i32 },
+      pcap_setfilter: { args: [FFIType2.ptr, FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_freecode: { args: [FFIType2.ptr], returns: FFIType2.void },
+      pcap_setnonblock: { args: [FFIType2.ptr, FFIType2.i32, FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_next_ex: { args: [FFIType2.ptr, FFIType2.ptr, FFIType2.ptr], returns: FFIType2.i32 },
+      pcap_geterr: { args: [FFIType2.ptr], returns: FFIType2.cstring },
+      pcap_close: { args: [FFIType2.ptr], returns: FFIType2.void }
     });
     this.api = library;
     return this.api;
@@ -15575,20 +15726,6 @@ function readCStringBuffer(buffer) {
 function npcapDllPath() {
   return path.join(process.env.SystemRoot ?? "C:\\Windows", "System32", "Npcap", "wpcap.dll");
 }
-async function isAdminOnlyInstall() {
-  try {
-    const child = Bun.spawn({
-      cmd: ["reg.exe", "query", "HKLM\\SYSTEM\\CurrentControlSet\\Services\\npcap\\Parameters", "/v", "AdminOnly"],
-      stdout: "pipe",
-      stderr: "ignore",
-      windowsHide: true
-    });
-    const output = await new Response(child.stdout).text();
-    return await child.exited === 0 && /AdminOnly\s+REG_DWORD\s+0x1\b/i.test(output);
-  } catch {
-    return false;
-  }
-}
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
@@ -15614,7 +15751,7 @@ function parseIpv4(data, context) {
   const declaredLength = data.readUInt16BE(2);
   if (declaredLength < headerLength)
     return;
-  return parseTransport(data, headerLength, Math.min(declaredLength, data.length), declaredLength > data.length, data[9], 4, formatIpv4(data, 12), formatIpv4(data, 16), context);
+  return parseTransport(data, headerLength, Math.min(declaredLength, data.length), declaredLength > data.length, data[9], 4, formatIpv42(data, 12), formatIpv42(data, 16), context);
 }
 function parseIpv6(data, context) {
   if (data.length < 40)
@@ -15685,7 +15822,7 @@ function parseTransport(data, offset, packetEnd, truncated, protocol, ipVersion2
   }
   return;
 }
-function formatIpv4(data, offset) {
+function formatIpv42(data, offset) {
   return `${data[offset]}.${data[offset + 1]}.${data[offset + 2]}.${data[offset + 3]}`;
 }
 
@@ -15705,7 +15842,7 @@ class WindowsTargetTracker {
   refreshing = false;
   published = false;
   lastRefreshError;
-  constructor(processName, protocols, onStatus, provider = new CommandTargetSnapshotProvider, onWarning = () => {}, refreshIntervalMs = TARGET_REFRESH_INTERVAL_MS) {
+  constructor(processName, protocols, onStatus, provider = new WindowsTargetSnapshotProvider, onWarning = () => {}, refreshIntervalMs = TARGET_REFRESH_INTERVAL_MS) {
     this.processName = processName;
     this.protocols = protocols;
     this.onStatus = onStatus;
@@ -15766,58 +15903,18 @@ class WindowsTargetTracker {
   }
 }
 
-class CommandTargetSnapshotProvider {
+class WindowsTargetSnapshotProvider {
   async snapshot(processName, protocols) {
-    const process2 = Bun.spawn({
-      cmd: ["tasklist.exe", "/FI", `IMAGENAME eq ${processName}`, "/FO", "CSV", "/NH"],
-      stdout: "pipe",
-      stderr: "ignore",
-      windowsHide: true
-    });
-    const processOutput = await new Response(process2.stdout).text();
-    const processIds = await process2.exited === 0 ? parseTaskList(processOutput) : [];
+    const processIds = findProcessIdsByName(processName);
     if (processIds.length === 0)
       return { processIds, endpoints: [] };
-    const outputs = await Promise.all(protocols.map(async (protocol) => {
-      const child = Bun.spawn({
-        cmd: ["netstat.exe", "-ano", "-p", protocol.toUpperCase()],
-        stdout: "pipe",
-        stderr: "ignore",
-        windowsHide: true
-      });
-      const output = await new Response(child.stdout).text();
-      return await child.exited === 0 ? parseNetstat(output, protocol) : [];
-    }));
     const selected = new Set(processIds);
-    return { processIds, endpoints: outputs.flat().filter((endpoint) => selected.has(endpoint.processId)) };
+    return {
+      processIds,
+      endpoints: listOwnedEndpoints(protocols).filter((endpoint) => selected.has(endpoint.processId))
+    };
   }
 }
-function parseTaskList(output) {
-  return output.split(/\r?\n/).flatMap((line) => {
-    const match = line.match(/^"(?:[^"]|"")*","(\d+)"/);
-    return match ? [Number(match[1])] : [];
-  }).sort((left, right) => left - right);
-}
-function parseNetstat(output, protocol) {
-  return output.split(/\r?\n/).flatMap((line) => {
-    const columns = line.trim().split(/\s+/);
-    if (columns[0]?.toLowerCase() !== protocol || columns.length < (protocol === "tcp" ? 5 : 4))
-      return [];
-    const local = parseEndpoint(columns[1]);
-    const processId = Number(columns[protocol === "tcp" ? 4 : 3]);
-    return local && Number.isInteger(processId) ? [{ protocol, ...local, processId }] : [];
-  });
-}
-function parseEndpoint(value) {
-  const bracketed = value.match(/^\[(.*)]:(\d+)$/);
-  if (bracketed)
-    return { address: bracketed[1], port: Number(bracketed[2]) };
-  const split = value.lastIndexOf(":");
-  if (split < 0)
-    return;
-  const port = Number(value.slice(split + 1));
-  return Number.isInteger(port) ? { address: value.slice(0, split), port } : undefined;
-}
 function endpointKey(protocol, address, port) {
   return `${protocol}|${address}|${port}`;
 }
@@ -15828,8 +15925,9 @@ function errorMessage2(error) {
 // src/capture/packet-capture.ts
 var POLL_INTERVAL_MS = 2;
 var MAX_POLL_BATCH = 128;
-var PENDING_PACKET_LIMIT = 4096;
-var PENDING_PACKET_MAX_AGE_MS = 1000;
+var PENDING_PACKET_LIMIT = 16384;
+var PENDING_PACKET_MAX_AGE_MS = TARGET_REFRESH_INTERVAL_MS * 5;
+var PENDING_DROP_REPORT_MS = 1e4;
 var systemRuntime = new SystemNpcapRuntime;
 async function getNpcapStatus() {
   return systemRuntime.status();
@@ -15851,6 +15949,8 @@ class PacketCapture extends EventEmitter {
   decodeFishNet = false;
   fishNetRpcMap;
   fishNetSessionDecoder = null;
+  droppedPending = 0;
+  droppedReportedAtMs = 0;
   _state = "stopped";
   constructor(dependencies = {}) {
     super();
@@ -15949,9 +16049,10 @@ class PacketCapture extends EventEmitter {
             packet.direction = direction;
             this.emitTransportPacket(packet);
           } else {
-            this.pending.push({ packet, observedAt: Date.now() });
-            if (this.pending.length > PENDING_PACKET_LIMIT)
-              this.pending.splice(0, this.pending.length - PENDING_PACKET_LIMIT);
+            if (this.pending.length >= PENDING_PACKET_LIMIT)
+              this.droppedPending += 1;
+            else
+              this.pending.push({ packet, observedAt: Date.now() });
           }
         }
       }
@@ -15967,13 +16068,19 @@ class PacketCapture extends EventEmitter {
     }
   }
   flushPending() {
-    if (!this.target || this.pending.length === 0)
+    if (!this.target)
       return;
+    if (this.pending.length === 0) {
+      this.reportDroppedPending();
+      return;
+    }
     const cutoff = Date.now() - PENDING_PACKET_MAX_AGE_MS;
     const remaining = [];
     for (const candidate of this.pending) {
-      if (candidate.observedAt < cutoff)
+      if (candidate.observedAt < cutoff) {
+        this.droppedPending += 1;
         continue;
+      }
       const direction = this.target.classify(candidate.packet);
       if (!direction)
         remaining.push(candidate);
@@ -15983,6 +16090,18 @@ class PacketCapture extends EventEmitter {
       }
     }
     this.pending = remaining;
+    this.reportDroppedPending();
+  }
+  reportDroppedPending() {
+    if (this.droppedPending === 0)
+      return;
+    const now = Date.now();
+    this.droppedReportedAtMs ||= now;
+    if (now - this.droppedReportedAtMs < PENDING_DROP_REPORT_MS)
+      return;
+    this.emitSafely("warning", `gave up on ${this.droppedPending} packets that could not be attributed to the target process`);
+    this.droppedPending = 0;
+    this.droppedReportedAtMs = now;
   }
   emitTransportPacket(packet) {
     if (packet.protocol === "tcp")
@@ -16065,6 +16184,8 @@ class PacketCapture extends EventEmitter {
     this.fishNetRpcMap = undefined;
     this.fishNetSessionDecoder?.reset();
     this.fishNetSessionDecoder = null;
+    this.droppedPending = 0;
+    this.droppedReportedAtMs = 0;
   }
 }
 function inferDirection(ipPacket, device) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kar-mi/spirit-vale-tools-capture",
-  "version": "2.4.2",
+  "version": "2.5.1",
   "description": "Passive Windows packet capture and Spirit Vale protocol decoding for Bun.",
   "license": "AGPL-3.0-only",
   "repository": {