This is a brief explanation of when to use Npcap and WinPCAP software.
Relative to all versions.
Npcap and WinPCAP are third party software applications used within the Symantec DLP solution to perform network packet capturing on traffic sent from either a SPAN or TAP.
It is a utility for Windows, and is used only with the Network Monitor Detection Server with a NIC.
It is not required or used by the Enforce server, Endpoint Prevent, Network Prevent for Web, or Discover servers.
For more details please see the DLP installation guide for your version on Symantec Data Loss Prevention Help Center and the third party software sites: