packetbeat: allow user to prevent Npcap installation on Windows

[efd6]

What does this PR do?

Allow user to prevent Npcap installation on Windows.

Why is it important?

Some users depend on software that uses Npcap pinned to other versions.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• [ ]

How to test this PR locally

Test locally on a windows machine with no npcap installed, and running with .\packetbeat -e -d '*' (binary must have been built with npcap installer asset in place) with the following packetbeat.yml.

packetbeat.interfaces.device: default_route

packetbeat.npcap:
  never_install: true

packetbeat.interfaces.poll_default_route: 1m

packetbeat.interfaces.internal_networks:
  - private

packetbeat.flows:
  timeout: 30s
  period: 10s

packetbeat.protocols:
- type: icmp
  # Enable ICMPv4 and ICMPv6 monitoring. The default is true.
  enabled: true

output.file:
  path: "./"
  filename: packetbeat-test

You will see the following two lines in the output

{"log.level":"warn","@timestamp":"2023-01-30T23:11:39.642-0800","log.logger":"npcap_install","log.origin":{"file.name":"beater/install_npcap.go","file.line":67},"message":"npcap installation/upgrade disabled by user","service.name":"packetbeat","ecs.version":"1.6.0"}
{"log.level":"warn","@timestamp":"2023-01-30T23:11:39.642-0800","log.logger":"npcap","log.origin":{"file.name":"beater/install_npcap.go","file.line":47},"message":"no version available for npcap","service.name":"packetbeat","ecs.version":"1.6.0"}

and then will shortly after packetbeat will terminate with

{"log.level":"error","@timestamp":"2023-01-30T23:11:39.673-0800","log.origin":{"file.name":"instance/beat.go","file.line":1070},"message":"Exiting: failed to get device list: couldn't load wpcap.dll","service.name":"packetbeat","ecs.version":"1.6.0"}
Exiting: failed to get device list: couldn't load wpcap.dll

Related issues

• Closes [Packetbeat] Disable install/auto-update of npcap #34420

Use cases

Screenshots

Logs

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-02-02T22:02:15.325+0000

• Duration: 47 min 33 sec

Test stats 🧪

Test	Results
Failed	0
Passed	1742
Skipped	19
Total	1761

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

• /package : Generate the packages and run the E2E tests.

• /beats-tester : Run the installation tests with beats-tester.

• run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

This option should be added to the asciidocs so that it's present in the website docs. What's here looks good.

[clakra]

Hello,
will this option also be available in the Network Packet Capture integration of the elastic-agent ?