This is in reference to https://www.winpcap.org/docs/docs_40_2/html/group__remote.html, the RPCAP protocol. Wireshark (on Windows) has support for connecting to passive mode deployment. And the RPCAP daemon can run on Windows or other OS, but much easier on Windows due to having it more readily available without building from source.
But I have yet to find a general example use or deployment of RPCAP active mode for the RPCAP server daemon connecting to a remote client (not Wireshark since it doesn't have support for it, so be another tool), at least not one where it is nicely articulated or documented in a blog or article or README, unless I've overlooked my internet search.
I did notice ExtraHop has such support for it in their sensor product solution where they customized the functionality for that. But I'm interested in a generic non-vendor based deployment of the feature.
Is it really that no one has really made (public/general) use of the feature since the inception of RPCAP active mode?
