Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Where can I find WinPcap in system control, I assumed it is running as a service but it seems I am mistaken.

I started WinPcap via command line (source):

runas /u:administrator "net start npf"

Before starting WinPcap Wireshark didn't show any capture interfaces and afterwards it does. So I assume it is running. But I can't find it in the services list of the task manager.

To narrow down the candidates I compared running services after starting and stopping WinCap but there is no difference.

How can I directly confirm that this "service" is running on Windows 8?


C:\WINDOWS\system32>sc query "npf"

SERVICE_NAME: npf
        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0

MYSTERIOUS:

sc query lists 85 services - none of which is "npf" - but sc query npf will find it.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Yes, you are right, WinPcap is a service (but mainly a driver), named NetGroup Packet Filter Driver. The fact is that it cannot be seen in the Windows Services Manager.

You can find it in the registry at :

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPF

Not tested, but it seems that you can change the way the service starts. Navigate to the registry key above. Then you will find a REG DWORD value named Start. Values are :

  • Value 0x3 : SERVICE_DEMAND_START
  • Value 0x2 : SERVICE_AUTO_START
  • Value 0x1 : SERVICE_SYSTEM_START

In the doc they say that it's work only on Windows NTx, but give it a try ! On my system it is set to 0x2.

To view it in a GUI, goto (i am talking about Windows7, hope it will work on Windows8) :

  1. Run msinfo32.exe
  2. Then expand Software environment
  3. Then choose System Drivers

Here you can get the status for npf service (but cannot interact with it)


Edit :

How can I directly confirm that this "service" is running on Windows 8?

You can use this from the command prompt to check the service state :

sc query "npf"

or this, to check specificaly if it is running :

sc query "npf" | findstr RUNNING
or 
sc query "npf" | find "RUNNING"

Edit 2 :

Mysterious : sc query lists 85 services - none of which is "npf" - but sc query npf will find it.

Seems normal. Regarding the doc this is the way sc works.

By default, SC lists only services, not drivers. NPF is more a driver.

  • To get all drivers : sc query type= driver (NPF will appears)

  • To get all (Services + Drivers) : sc query type= all (NPF will appears also)

share|improve this answer
    
nope, to bad, that is not working on Win 8. I can display hidden devices but there is no "non-plug and play drivers" category and no device named as you stated. –  Raffael Jan 5 at 16:25
    
Ok, i am actually installing Windows8 on a VM to have a look :( –  user2196728 Jan 5 at 16:26
    
@Яaffael I see that you have marked this as answered ! Did you finally find the GUI i was talking about ? –  user2196728 Jan 5 at 16:48
    
nope, not really. but you provided a lot of valuable information. essentially what I would like to know is "how can I see all services currently running?". I can confirm npf running, but only if I know its name. that's weird. it is in deed btw listed in the registry as you stated. –  Raffael Jan 5 at 16:50
    
pls have a look at added section at the end –  Raffael Jan 5 at 16:59
show 3 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.