Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I just installed WireShark, which also installed WinPcap.

During the installation it said "do you want xxx to start automatically", which I answered yes.

Now I would like to stop the service when I am not running wireshark, but cannot find a service in the list with name wireshark or winPcap.

Is there a service that I can stop? Or do I need uninstall WireShark?

share|improve this question
add comment

2 Answers

up vote 7 down vote accepted

The WinPCap services is known as "NPF" (NetGroup Packet Filter), you can start/stop it on command line with

c:\>net start npf
The NetGroup Packet Filter Driver service was started successfully.

C:\>net stop npf
The NetGroup Packet Filter Driver service was stopped successfully.

To find it in a GUI, you'll have to open "Properties" for "My Computer", then select the "Hardware" tab, open "Device Manager". Here, select View -> Show hidden devices, open up Non-Plug and Play Drivers, right-click on NetGroup Packet Filter Driver and select Properties from the menu, thus you will get a "NetGroup Packet Filter Driver Properties" window.

share|improve this answer
    
Can I find NPF service in GUI, in Services applet? –  Dims Aug 31 '13 at 20:14
    
@Dims : I updated my answer for the GUI part. –  Cédric Julien Sep 3 '13 at 8:44
add comment

Other commands that may be of interest are:

Change NPF to run manually

sc config npf start= demand

Change NPF to run automatically at boot

sc config npf start= auto

share|improve this answer
    
Can I find NPF somewhere in GUI? –  Dims Aug 31 '13 at 20:13
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.