Wireshark the npf driver

Viewed 31k times. When I start up Wireshark, why do I see this message? Improve this question. Matthew Simoneau Matthew Simoneau 1 1 gold badge 7 7 silver badges 17 17 bronze badges.

Add a comment. Active Oldest Votes. You need to run Wireshark with administrator privileges. Exit Wireshark. Find Wireshark on the Start Menu. Right-click on it. Select "Run as administrator", Click "Yes" in the user account control dialog. Improve this answer. A better solution offered here is the following: Open a command prompt cmd. Possible values and lot are documented by Microsoft. NPF has a start type 2, which is for a "Non-PnP driver that must be started by the service control manager.

Theoretically, you could tinker with the start type, so that NPF looks like an essential driver to Windows. Personally, I think this is a bad idea.

It could leave your system unbootable to a point that you require a reinstallation. In safe mode, Windows will only load very essential drivers. These drivers have only very small to no requirements.

NPF certainly requires a driver for the network card. There might be other dependencies, like NDIS or some mini driver. I don't know, if NPF has error handling for such harsh and unexpected conditions. Your Systems working as one. Search Search. Secondary menu RTI. You are here Home » Knowledge Base » Solutions. Create new account Request new password. I did say "I have the same problem Assuming there is a solution.

A totally automatic way? No, because you must start the NPF service as administrator, but you shall not run Wireshark as administrator. When it opened, input net start npf , then the NPF driver is successfully opened. That is,the file npf. If you are using Windows XP, login with administrator account then open cmd, input net start npf. This worked for me and seems to be the best solution if you don't want the WinPCap-Drivers being loaded everytime when Windows starts.

Don't do that!! There is a good reason security for the privilege separation.