Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was wondering, if the TCP/IP stack is part of the kernel or running as a service? Where do I find the TCP/IP stack in sysinternals ProcExp?

share|improve this question
I belive the TCP/IP stack is part of the kernel - why, do you want to be able to shut it down? – Nate Koppenhaver Oct 25 '11 at 17:17
for example yes, but I was just curious where to find it? – JohnnyFromBF Oct 25 '11 at 17:20
tcpip.sys is IPv4 and tcpip6.sys is IPv6. They're in the /WINDOWS/SYSTEM32/drivers dir. Since they are .sys drivers they will run in the kernel and probably not show up in ProcExp – Nate Koppenhaver Oct 25 '11 at 17:22
up vote 0 down vote accepted

The TCP/IP stack is implemented as a driver (tcpip.sys for IPv4 and tcpip6.sys for IPv6), which means that it runs in the kernel and will not be listed as a process with ProcExp, though if it has a services viewer you will be able to find it there.

I don't have ProcExp but I do use Process Hacker (which is pretty much the same) so here is a screenshow of Process Hacker's running services viewer with the TCPIP service highlighted:

Process Hacker with tcpip service highlighted

From there you should be able to stop, start, and disable the service (you can also do that with msconfig under the 'Services' tab -- for WinXP it's listed as 'TCP/IP NetBIOS Helper')

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .