Observability

Server Crash or BSOD Occurs After Installing Npcap 1.81 (Bundled with SolarWinds Platform 2025.4)

This article provides information about an issue where a Windows server may experience a Blue Screen of Death (BSOD) or crash after the Npcap 1.81 driver (bundled with SolarWinds Platform 2025.4) is installed.

First published date

12/26/2025 8:39 PM

Last published date

2/5/2026 9:37 PM

Overview

Users may experience system crashes or BSOD events on Windows servers where Npcap is installed as part of the SolarWinds Platform 2025.4 installation, which bundles Npcap version 1.81. Npcap may also be deployed to agent-monitored machines depending on enabled features.

Affected Npcap versions (1.81 through 1.84) contain a known defect that can result in a 1-byte read past the end of a Memory Descriptor List (MDL) data buffer, which can trigger kernel-level crashes.

Based on field reports and internal investigation, this behavior has been predominantly observed on Windows Server 2016, while newer operating systems such as Windows Server 2022 and Windows Server 2025 appear unaffected.

Npcap may be present on systems due to the following SolarWinds features:

Connection Quality polling (SAM / Application Dependencies)
NetPath
DPI / Quality of Experience (QoE)
Installation on polling engines as part of the platform installer

In later SolarWinds Platform releases, Npcap updates are delivered through officially bundled installers and agent plugins. On agent-managed nodes, deployment of Npcap depends on agent health, auto-update configuration, and whether Npcap-dependent features are enabled.

Product section

Hybrid Cloud Observability

Cause

The issue is caused by a defect in Npcap versions 1.81 through 1.84, which can result in kernel instability under certain conditions. When this occurs, the Windows operating system may crash, resulting in a blue screen of death (BSOD).

The following issue impact the following Windows operating systems:

Windows Server 2016

Resolution

Option 1: Upgrade the operating system

If possible, upgrade the affected system from Windows Server 2016 to Windows Server 2022 or Windows Server 2025. Based on current reports, the issue does not appear to affect newer Windows Server versions.

Option 2: Uninstall Npcap if functionality is not required

If Npcap-dependent features are not required, Npcap can be uninstalled from the affected system.

Important considerations:

Uninstalling Npcap will disable features that rely on it, including:

Connection Quality polling
NetPath
DPI / QoE

Application Dependency mapping will continue to function; however, latency and packet loss metrics will no longer be collected.

Before uninstalling:

Disable Connection Quality polling and any other features that rely on Npcap.

Option 3: Upgrade to a supported SolarWinds Platform release (Recommended)

To resolve this issue, please upgrade to SolarWinds Platform 2025.4.3 and above. In the following release, Npcap was upgraded to 1.85.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.