WinPcap Packet-Capture Driver

For administrators troubleshooting network measurement on a Windows endpoint. All commands below require an elevated Command Prompt (Run as administrator).

How the driver works

The Agent measures network performance by capturing network traffic. Capture relies on three parts:

Component	Type	Role
PGwpcap.dll and PGpacket.dll	User-mode libraries	The capture API the Agent calls.
PGNPF	Windows service	Tells Windows to load the driver file.
C:\Windows\System32\drivers\pgnpf.sys	Kernel driver file	Captures packets from the network adapter.

The Agent loads PGwpcap.dll, which connects to the PGNPF service, which loads pgnpf.sys. A working setup needs the file on disk and the service running. The Agent installer places pgnpf.sys on disk; the PGNPF service is created and started automatically the first time the Agent captures.

Note

If a separate WinPcap installation (wpcap.dll and packet.dll, for example from Wireshark) is present on the computer, the Agent uses that library and its driver instead of PGwpcap.dll and PGNPF. In that case the PGNPF checks on this page don’t apply. See Agents and Wireshark / WinPCap.

If the driver is not running, the Agent still runs but network measurement is unavailable.

Driver status in the Agent information

You find the status in the PerformanceGuard web interface: select ANALYZE > Computers > Computer Search, open the computer, and on the Computer Info tab select Agent Info. The status is listed under Options.

Message	Meaning	Action
Winpcap Driver OK	Driver loaded, capture working.	None.
Winpcap Driver Could not initialize	Agent could not open the network adapter through the driver.	Check and start the driver (below).
Winpcap Driver Not installed	Agent could not load the capture libraries.	Repair or reinstall the Agent.

Common causes of the warning: the PGNPF service is stopped, the driver was not installed, or Windows security settings block it.

Check the driver

• Cmd

sc query PGNPF

Look at the STATE line:

Result	Meaning	Action
STATE : 4 RUNNING	Loaded and running.	None. If the Agent still complains, restart the Agent service.
STATE : 1 STOPPED	Installed but not running.	Start it (Start the driver).
service does not exist	Not registered.	Register it (Register, reset, and remove the service) or reinstall the Agent.

Also confirm the file exists:

• Cmd

dir C:\Windows\System32\drivers\pgnpf.sys

If it is missing, reinstall the Agent — do not copy the file from another device.

Start the driver

• Cmd

sc start PGNPF

Confirm with sc query PGNPF (expect STATE : 4 RUNNING), then restart the Agent service or reboot so the Agent re-connects. The Agent should then report Winpcap Driver OK.

Register, reset, and remove the service

pgnpf.sys is the driver file; PGNPF is the service that loads it. If the file is present but the service is missing, register it:

• Cmd

sc create PGNPF type= kernel start= demand error= normal binPath= System32\drivers\pgnpf.sys DisplayName= "WinPcap Packet Driver (PGNPF)"
sc start PGNPF

Note the space after each = (type= kernel, not type=kernel) — required by sc.

Clean re-registration (if the service is misconfigured):

• Cmd

sc stop PGNPF
sc delete PGNPF
sc create PGNPF type= kernel start= demand error= normal binPath= System32\drivers\pgnpf.sys DisplayName= "WinPcap Packet Driver (PGNPF)"
sc start PGNPF

sc delete removes only the service entry, not the file. Repairing/reinstalling the Agent also re-creates the service automatically.

Diagnose problems

Symptom	Cause	Action
sc query → service does not exist	Not registered.	Register (Register, reset, and remove the service) or reinstall.
dir pgnpf.sys → File Not Found	File missing.	Reinstall the Agent.
sc start → Error 2	Service points to a missing file.	Verify file; re-register (Register, reset, and remove the service).
sc start → Error 5	Prompt not elevated.	Reopen as administrator.
sc start → Error 577 / 1275	Windows blocked the driver because of its signature or a security policy.	Contact PerformanceGuard support (below).
STATE : 4 RUNNING but Agent still fails	Agent not re-connected.	Restart the Agent service or reboot.

Useful checks:

• Cmd

sc qc PGNPF

BINARY_PATH_NAME should point to System32\drivers\pgnpf.sys. Driver load failures are also logged in Event Viewer → Windows Logs → System (source Service Control Manager).

If it still will not start: on some devices, Windows security features such as Memory Integrity (Core Isolation) or a driver block policy prevent the driver from loading. Don’t turn off Secure Boot, Memory Integrity, or other Windows security features to work around this. Send the output of sc query PGNPF and sc qc PGNPF, the related System events, and the Agent status to PerformanceGuard support.