Winnipeg Photographer

Date Posted: Mar 31, 2009

Author: Jared Heinrichs

Posted in WireShark.

The NPF driver isn't running – Wireshark

Wireshark – The NPF driver isn’t running

As soon as I opened my wireshark, the message popped up: “The NPF driver isn’t running…

As a local administrator do this:

net start npf

Now go back and open WireShark. Everything will be ok ;)

42 Responses

  1. Your post has been found. I thank you for this information, as it worked quite well.
    ~Scott

    2. Scott on January 19th, 2010 at 12:06 pm

  2. Is there anyway to run this at startup?

    3. Filipe on March 3rd, 2010 at 12:43 pm

  3. Thanks!

    4. Joao on April 20th, 2010 at 10:30 am

  4. I’ve tried doing this, but when I do it gives me this message “System error 5 has occured. Access is denied”
    I am using Win7 Pro in administrator mode, and I even used the run program with control+alt+enter to make sure I was in admin command prompt. What else can I do?

    5. Tim on April 27th, 2010 at 4:08 pm

  5. Tim, make sure you are running Wireshark itself as administrator.

    6. Sarah on May 4th, 2010 at 9:02 pm

  6. click on the shortcut, select properties, select run as administator. when she starts npf will start also.

    7. tom on May 5th, 2010 at 9:00 am

  7. Run command prompt as admin not as user admin. you need to be in the C:/windos/system32/ directory to run the ‘net start npf’ command as admin

    8. Nik on May 10th, 2010 at 4:46 pm

  8. @Tim

    You can start the driver by hand before starting Wireshark and stop it afterwards.
    Using Wireshark running in a user account could look like:
    Start the NPF driver:
    runas /u:administrator “net start npf”
    Start Wireshark as a user and work with it, including capturing, until the specific job is finished.
    Stop the NPF driver again:
    runas /u:administrator “net stop npf”

    9. Lazfroc on May 11th, 2010 at 2:57 am

  9. Thank you!

    10. António Santos on May 17th, 2010 at 12:35 pm

  10. Running it as an admin worked for me.

    Thanks.

    11. Diana on June 5th, 2010 at 8:44 am

  11. Ran the program in administrative mode. Worked fine. Loaded all drivers and everything.

    12. Chris on June 10th, 2010 at 1:02 am

  12. Thanks for the solution!

    Simple but effective ;)

    13. Herjan on June 29th, 2010 at 1:03 am

  13. Thanks!!

    14. J-Rock on August 21st, 2010 at 7:11 pm

  14. Hi,

    I am new at using Wireshark. I need to trace packets from a darwin streaming server using VLC at the client. TCP connection establishment, RTP data packets and RTCP packets and things like that. I have setup the darwin server and also the Wireshark. Any suggestions on how should I proceed.

    15. Aashish on September 30th, 2010 at 12:13 pm

  15. For beginners I would try and look at this article: http://portforward.com/networking/wireshark.htm

    16. Jared Heinrichs on September 30th, 2010 at 6:12 pm

  16. Running as Administratoe worked for me….
    Thank you very much

    17. Tshego on October 12th, 2010 at 2:28 am

  17. Thanks so much!! Effective and fast solution!!!

    18. nacron on November 6th, 2010 at 1:09 am

  18. thanks tom. its working the way you said.

    19. ahsan on November 9th, 2010 at 2:49 pm

  19. thanks tom and sarah

    20. dMan on November 19th, 2010 at 9:32 pm

  20. Thanks a lot! That’s exactly what I am looking for!

    21. vRussell on December 29th, 2010 at 10:57 am

  21. Thanks a lot. it is really works like magic :D

    22. wahyu on January 20th, 2011 at 3:40 am

  22. Install Winpcap

    23. Gui on February 23rd, 2011 at 5:35 pm

  23. Thanks man, it worked great

    24. SSK on April 1st, 2011 at 10:01 am

  24. it worked after running as admin thanks!

    25. thokchom sanjeet on April 10th, 2011 at 8:34 pm

  25. it works. Thanks

    26. Araneda on April 18th, 2011 at 2:30 pm

  26. Thanks alot. It worked for me too.

    27. Eteng Socrates on April 20th, 2011 at 3:35 am

  27. The thing is that you must run it as administrator

    28. Anny on May 13th, 2011 at 6:14 am

  28. Yes, this worked great.

    29. Ibrahim Aziz on May 23rd, 2011 at 12:08 pm

  29. i i am using windows 7 ultimate

    i cant understand “net start npf”

    i run this but it showing me search result

    please help me.

    30. Raj on June 13th, 2011 at 8:19 pm

  30. “net start npf” is needed to be run from a command prompt. Right click a shortcut to the command prompt and tell it to run as an administrator. A little black command prompt window will open. type those three words exactly how you see them including the spaces. It will work.

    31. Jared Heinrichs on June 14th, 2011 at 6:52 am

  31. Where ever you all may be .. Thanks dudes! net stat npf worked for me

    32. Walt on June 15th, 2011 at 5:50 am

  32. You’re welcome. You should check out the rest of my site and maybe add my RSS feed to your reading :) Have a good one.

    33. Jared Heinrichs on June 15th, 2011 at 7:46 am

  33. By running as an administrator i am able to find the interfaces but the packet sniffing does not show up, kindly share your thoughts.

    34. Rajesh on July 1st, 2011 at 11:52 am

  34. Thanks, it worked :)

    35. SomeOne on September 11th, 2011 at 5:45 am

  35. Works OK. Win 7, installed Wireshark, worked fine the first time the program is runned. Turn off the PC, turn on, start Wireshark and since then message “NPF driver not found” is shown.

    Tried : “net start npf” from command prompt, but doesnt work, says “Access denied”.

    Right click on shortcut, properties, enable “run as admin”, ok. Then click on shortcut and goes OK.

    36. Orlando Canino on September 26th, 2011 at 2:28 am

  36. Thanks a lot

    37. Thanks on October 2nd, 2011 at 9:45 pm

  37. I just reinstalled my pc, then the WireShark didn’t work for me …even after doing what you suggested…cmd said server invalid

    38. Fiona on October 18th, 2011 at 1:07 am

  38. The way that worked for me was:
    Right Click on Short Cut, Properties, Compatability Tab, where it says Privilege Level, tick “run this program as an administrator”.

    39. Simon J on November 11th, 2011 at 2:58 pm

  39. ThanX guys…. U guys are such a help… I have been looking for this soln for quite sometime

    40. Bhabani on December 31st, 2011 at 1:47 pm

  40. worked 100%.

    41. William on February 25th, 2012 at 5:38 am

  41. Was to lazy to think for myself, googled and found this sollution which worked out nicely. Thanks!

    42. Anders on March 20th, 2012 at 2:49 am

  42. `net start npf` works for me, thanks!

    Still wondering, what is npf anyway?
    It’s nowhere in services.msc, nor `wmic service list`.

    43. azziporah on March 29th, 2012 at 8:42 am

Leave a Reply