This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Where are the Winpcap / Network Packet filter drivers located?

0

I'm wondering this primarily for educational purposes. I installed Winpcap, but can't actually find reference to it on the system.

In services.msc I see no reference to Winpcap or NTP.

I'm able to start the service by typing "net start ntp", and it confirms that the NetGroup Packet Filter has started. However if I type "net start" again, it generates a list of the windows services that are running, and I see no reference to the NetGroup Packet Filter which I just started and is running, nor a reference to winpcap.

So basically, I can start and stop it, and it works, but I can't actually find record of it running, as if its invisible. So how can I find it?

note: wireshark works just fine, I'm just wondering purely for my own knowledge of understanding how this service or driver can be seemingly invisibly running.

asked 08 Jan '15, 14:01

mxmaniac's gravatar image

mxmaniac
0114
accept rate: 0%


One Answer:

2

You can query the status of the service with the sc.exe command (service control):

sc query npf

npf is the "NetGroup Packet Filter Driver" service comming with Winpcap.

answered 08 Jan '15, 23:07

Uli's gravatar image

Uli
9031515
accept rate: 29%

thank you!

(09 Jan '15, 12:56) mxmaniac