packetbeat/npcap: unload DLL during install operation

packetbeat/npcap/npcap.go

@@ -68,6 +68,18 @@ func Install(ctx context.Context, log *logp.Logger, path, dst string, compat boo
 }
 
 func install(ctx context.Context, log *logp.Logger, path, dst string, compat bool) error {
+	if pcap.Version() != "" {
+		// If we are here there is a runtime Npcap DLL loaded. We need to
+		// unload this to prevent the application being killed during the
+		// install.
+		//
+		// See https://npcap.com/guide/npcap-users-guide.html#npcap-installation-uninstall-options.
+		err := unloadWinPCAP()
+		if err != nil {
+			return fmt.Errorf("npcap: failed to unload Npcap DLL: %w", err)
+		}
+	}
+
 	args := []string{"/S", "/winpcap_mode=no"}
 	if compat {
 		args[1] = "/winpcap_mode=yes"
@@ -96,7 +108,7 @@ func install(ctx context.Context, log *logp.Logger, path, dst string, compat boo
 		return fmt.Errorf("npcap: failed to install Npcap: %w", err)
 	}
 
-	return reloadWinPCAP()
+	return loadWinPCAP()
 }
 
 func Upgradeable() bool {

packetbeat/npcap/npcap_other.go

@@ -22,4 +22,4 @@ package npcap
 
 func loadWinPCAP() error { return nil }
 
-func reloadWinPCAP() error { return nil }
+func unloadWinPCAP() error { return nil }

packetbeat/npcap/npcap_windows.go

@@ -24,10 +24,4 @@ import "github.com/google/gopacket/pcap"
 
 func loadWinPCAP() error { return pcap.LoadWinPCAP() }
 
-func reloadWinPCAP() error {
-	err := pcap.UnloadWinPCAP()
-	if err != nil {
-		return err
-	}
-	return pcap.LoadWinPCAP()
-}
+func unloadWinPCAP() error { return pcap.UnloadWinPCAP() }