Where can I find WinPcap in system control, I assumed it is running as a service but it seems I am mistaken.

I started WinPcap via command line (source):

runas /u:administrator "net start npf"

Before starting WinPcap Wireshark didn't show any capture interfaces and afterwards it does. So I assume it is running. But I can't find it in the services list of the task manager.

To narrow down the candidates I compared running services after starting and stopping WinCap but there is no difference.

How can I directly confirm that this "service" is running on Windows 8?

C:\WINDOWS\system32>sc query "npf"

        TYPE               : 1  KERNEL_DRIVER
        STATE              : 4  RUNNING
                                (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0


sc query lists 85 services - none of which is "npf" - but sc query npf will find it.

  • same for npcap (nmap/zenmap/Winpcap)... misterious... I can start and stop from command line or Powershelll... but not appearing in list...
    – ZEE
    Nov 27, 2020 at 15:21

2 Answers 2


Yes, you are right, WinPcap is a service (but mainly a driver), named NetGroup Packet Filter Driver. The fact is that it cannot be seen in the Windows Services Manager.

You can find it in the registry at :


Not tested, but it seems that you can change the way the service starts. Navigate to the registry key above. Then you will find a REG DWORD value named Start. Values are :

  • Value 0x2 : SERVICE_AUTO_START

In the doc they say that it's work only on Windows NTx, but give it a try ! On my system it is set to 0x2.

To view it in a GUI, goto (i am talking about Windows7, hope it will work on Windows8) :

  1. Run msinfo32.exe
  2. Then expand Software environment
  3. Then choose System Drivers

Here you can get the status for npf service (but cannot interact with it)

Edit :

How can I directly confirm that this "service" is running on Windows 8?

You can use this from the command prompt to check the service state :

sc query "npf"

or this, to check specificaly if it is running :

sc query "npf" | findstr RUNNING
sc query "npf" | find "RUNNING"

Edit 2 :

Mysterious : sc query lists 85 services - none of which is "npf" - but sc query npf will find it.

Seems normal. Regarding the doc this is the way sc works.

By default, SC lists only services, not drivers. NPF is more a driver.

  • To get all drivers : sc query type= driver (NPF will appears)

  • To get all (Services + Drivers) : sc query type= all (NPF will appears also)

  • nope, to bad, that is not working on Win 8. I can display hidden devices but there is no "non-plug and play drivers" category and no device named as you stated.
    – Raffael
    Jan 5, 2014 at 16:25
  • Ok, i am actually installing Windows8 on a VM to have a look :( Jan 5, 2014 at 16:26
  • @Яaffael I see that you have marked this as answered ! Did you finally find the GUI i was talking about ? Jan 5, 2014 at 16:48
  • nope, not really. but you provided a lot of valuable information. essentially what I would like to know is "how can I see all services currently running?". I can confirm npf running, but only if I know its name. that's weird. it is in deed btw listed in the registry as you stated.
    – Raffael
    Jan 5, 2014 at 16:50
  • pls have a look at added section at the end
    – Raffael
    Jan 5, 2014 at 16:59

If you browse to the 'Run' dialog (windows key + s, then type run for windows 8.1+) and type 'msinfo32' this will open and advanced system information dialog. Expand 'Software Environment' then select System Drivers. If you click on the heading 'name' it will sort them in order and you should find npf present, with its status in the columns to the right.

Information gleaned from here: http://www.winpcap.org/misc/faq.htm#Q-3 Tested on Windows 8.1 and Windows 10 Technical Preview.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.