Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I start up Wireshark, why do I see this message?

"The NPF driver isn't running. You may have trouble capturing or listing interfaces."

share|improve this question

2 Answers 2

up vote 11 down vote accepted

You need to run Wireshark with administrator privileges.

  1. Exit Wireshark.
  2. Find Wireshark on the Start Menu.
  3. Right-click on it.
  4. Select "Run as administrator",
  5. Click "Yes" in the user account control dialog.
share|improve this answer

It's really best not to run Wireshark as Administrator. See here for an explanation - bugs in the dissector can do a lot more damage when it runs as administrator. A better solution (offered here) is the following:

  • Open a command prompt (cmd.exe) using the "Run as administrator" option
  • Run the command sc qc npf
    You will see output similar to this:

    C:\Windows\system32>sc qc npf
    [SC] QueryServiceConfig SUCCESS
        TYPE               : 1  KERNEL_DRIVER
        START_TYPE         : 3   DEMAND_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : system32\drivers\npf.sys
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : NetGroup Packet Filter Driver
        DEPENDENCIES       :
  • If it looks like this, you will need to start the service using sc start npf
    so that it displays STATE : 4 RUNNING.

  • To start the service automatically in future, use sc config npf start= auto
    (that space after the equals sign is important)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.