Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just installed WireShark, which also installed WinPcap.

During the installation it said "do you want xxx to start automatically", which I answered yes.

Now I would like to stop the service when I am not running wireshark, but cannot find a service in the list with name wireshark or winPcap.

Is there a service that I can stop? Or do I need uninstall WireShark?

share|improve this question
up vote 17 down vote accepted

The WinPCap services is known as "NPF" (NetGroup Packet Filter), you can start/stop it on command line with

c:\>net start npf
The NetGroup Packet Filter Driver service was started successfully.

C:\>net stop npf
The NetGroup Packet Filter Driver service was stopped successfully.

To find it in a GUI, you'll have to open "Properties" for "My Computer", then select the "Hardware" tab, open "Device Manager". Here, select View -> Show hidden devices, open up Non-Plug and Play Drivers, right-click on NetGroup Packet Filter Driver and select Properties from the menu, thus you will get a "NetGroup Packet Filter Driver Properties" window.

share|improve this answer
Can I find NPF service in GUI, in Services applet? – user102132 Aug 31 '13 at 20:14
@Dims : I updated my answer for the GUI part. – Cédric Julien Sep 3 '13 at 8:44

Other commands that may be of interest are:

Change NPF to run manually

sc config npf start= demand

Change NPF to run automatically at boot

sc config npf start= auto

share|improve this answer
Can I find NPF somewhere in GUI? – user102132 Aug 31 '13 at 20:13
See the answer by Cédric Julien, you can use the device manager. – Ale Mar 10 '15 at 15:26

Though I've always found the command line method to be simpler, there is a GUI way to do this too.

In device manager, select "Show Hidden Devices" on the view menu, then under "Non-Plug and Play Drivers", the "NetGroup Packet Filter Driver" is listed. Double-click or right-click and select "Properties"

On the "Driver" tab of the properties page, the current status and "Start" or "Stop" buttons are displayed.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.