Stopping the WinPcap Packet capture service

Question

I just installed WireShark, which also installed WinPcap.

During the installation it said "do you want xxx to start automatically", which I answered yes.

Now I would like to stop the service when I am not running wireshark, but cannot find a service in the list with name wireshark or winPcap.

Is there a service that I can stop? Or do I need uninstall WireShark?

Cédric Julien · Accepted Answer · 2013-09-03T08:44:07.867

20

The WinPCap services is known as "NPF" (NetGroup Packet Filter), you can start/stop it on command line with

c:\>net start npf
The NetGroup Packet Filter Driver service was started successfully.

C:\>net stop npf
The NetGroup Packet Filter Driver service was stopped successfully.

To find it in a GUI, you'll have to open "Properties" for "My Computer", then select the "Hardware" tab, open "Device Manager". Here, select View -> Show hidden devices, open up Non-Plug and Play Drivers, right-click on NetGroup Packet Filter Driver and select Properties from the menu, thus you will get a "NetGroup Packet Filter Driver Properties" window.

edited Sep 03 '13 at 08:44

answered Oct 04 '11 at 14:09

Cédric Julien

391
6
12

Can I find NPF service in GUI, in `Services` applet? – Aug 31 '13 at 20:14
@Dims : I updated my answer for the GUI part. – Cédric Julien Sep 03 '13 at 08:44

score 9 · Answer 2 · edited Jun 11 '20 at 10:02

9

Other commands that may be of interest are:

Change NPF to run manually

sc config npf start= demand

Change NPF to run automatically at boot

sc config npf start= auto

edited Jun 11 '20 at 10:02

Community

1

answered Nov 06 '12 at 19:57

Andrew S

498
3
7
12

Can I find NPF somewhere in GUI? – Aug 31 '13 at 20:13
See the answer by Cédric Julien, you can use the device manager. – Ale Mar 10 '15 at 15:26

score 0 · Answer 3 · answered Sep 04 '14 at 18:24

Though I've always found the command line method to be simpler, there is a GUI way to do this too.

In device manager, select "Show Hidden Devices" on the view menu, then under "Non-Plug and Play Drivers", the "NetGroup Packet Filter Driver" is listed. Double-click or right-click and select "Properties"

On the "Driver" tab of the properties page, the current status and "Start" or "Stop" buttons are displayed.

Stopping the WinPcap Packet capture service

3 Answers3

Change NPF to run manually

Change NPF to run automatically at boot