Home / server / Questions / 318319
Accepted
Shiraz Bhaiji
Asked: 2011-10-05 05:42:29 +0800 CST

Stopping the WinPcap Packet capture service

  • 772

I just installed WireShark, which also installed WinPcap.

During the installation it said "do you want xxx to start automatically", which I answered yes.

Now I would like to stop the service when I am not running wireshark, but cannot find a service in the list with name wireshark or winPcap.

Is there a service that I can stop? Or do I need uninstall WireShark?

service windows-xp wireshark winpcap

3 Answers

  1. Best Answer

    The WinPCap services is known as "NPF" (NetGroup Packet Filter), you can start/stop it on command line with 

    c:\>net start npf
The NetGroup Packet Filter Driver service was started successfully.

C:\>net stop npf
The NetGroup Packet Filter Driver service was stopped successfully.

    To find it in a GUI, you'll have to open "Properties" for "My Computer", then select the "Hardware" tab, open "Device Manager". Here, select View -> Show hidden devices, open up Non-Plug and Play Drivers, right-click on NetGroup Packet Filter Driver and select Properties from the menu, thus you will get a "NetGroup Packet Filter Driver Properties" window.

    • 20

  2. Other commands that may be of interest are:

    Change NPF to run manually

    sc config npf start= demand

    Change NPF to run automatically at boot

    sc config npf start= auto

    • 9

  3. Though I've always found the command line method to be simpler, there is a GUI way to do this too.

    In device manager, select "Show Hidden Devices" on the view menu, then under "Non-Plug and Play Drivers", the "NetGroup Packet Filter Driver" is listed. Double-click or right-click and select "Properties"

    On the "Driver" tab of the properties page, the current status and "Start" or "Stop" buttons are displayed.

    • 0