You can change the start settings of the NPF service to 'automatic' or 'system' at any time using the following methods:įrom the Device Manager you can select View->Show hidden devices, then open Non-Plug and Play Drivers and right click on NetGroup Packet Filter Driver. The easiest way to do this is to select Start WinPcap service 'NPF' at startup in the Wireshark installer. Start the NPF driver automatically at system start There are three possible solutions to start Wireshark with the privilege to capture:ĭisadvantage: It's very unsecure running Wireshark this way as every possible Wireshark exploit will be running with the administrator account being able to compromise the whole system. Please note that this is not a limitation of the Wireshark implementation, but of the underlying WinPcap driver see this note in the WinPcap FAQ. It might not be desirable that any local user can also capture from the network while the driver is loaded, but this can't be currently circumvented. Note: Simply stopping Wireshark won't stop the WinPcap driver! Once the driver is loaded, every local user can capture from it until it's stopped again. The WinPcap driver (called NPF) is loaded by Wireshark when it starts to capture live data. If you are running inside a virtual machine, make sure the host allows you to put the interface into promiscous mode.

Limiting capture permission to only one group.

Setting network privileges for dumpcap if your kernel and file system don't support file capabilities.

Setting network privileges for dumpcap if your kernel and file system support file capabilities.

Other Linux based systems or other installation methods.Debian, Ubuntu and other Debian derivatives.

GNU/Linux distributions, Wireshark is installed using a package manager.Platform-Specific information about capture privileges.

Wireshark android permission