# WinPcap Packet-Capture Driver

> Troubleshoot the WinPcap driver the agent uses to capture network traffic, from an elevated command prompt.

Source: https://docs.capaone.com/performanceguard/troubleshooting/troubleshoot-agent/winpcap-packet-capture-driver/  
Product: PerformanceGuard — a separate CapaSystems product; do not apply this page to any other.

For administrators troubleshooting network measurement on a Windows endpoint. All
commands below require an **elevated Command Prompt** (Run as administrator).

## How the driver works

The Agent measures network performance by capturing network traffic. Capture relies
on three parts:

| Component | Type | Role |
|---|---|---|
| `PGwpcap.dll` | User-mode library | The capture API the Agent calls. |
| **PGNPF** | Windows service | Tells Windows to load the driver file. |
| `C:\Windows\System32\drivers\pgnpf.sys` | Kernel driver file | Captures packets from the network adapter. |

The Agent loads `PGwpcap.dll`, which connects to the **PGNPF** service, which loads
`pgnpf.sys`. A working setup needs the **file on disk** *and* the **service running**.
The Agent installer places `pgnpf.sys` on disk; the PGNPF service is created and
started automatically the first time the Agent captures.

If the driver is not running, the Agent still runs but **network measurement is
unavailable**.

## Driver status in the Agent information

| Message | Meaning | Action |
|---|---|---|
| **Winpcap Driver OK** | Driver loaded, capture working. | None. |
| **Winpcap Driver Could not Initialize** | Agent could not connect to the driver. | Check and start the driver (below). |

Common causes of the warning: the PGNPF service is stopped, the driver was not
installed, or Windows security settings block it.

## Check the driver

**Cmd**

```cmd
sc query PGNPF
```

Look at the **STATE** line:

| Result | Meaning | Action |
|---|---|---|
| `STATE : 4 RUNNING` | Loaded and running. | None. If the Agent still complains, restart the Agent service. |
| `STATE : 1 STOPPED` | Installed but not running. | Start it (**Start the driver**). |
| *service does not exist* | Not registered. | Register it (**Register, reset, and remove the service**) or reinstall the Agent. |

Also confirm the file exists:

**Cmd**

```cmd
dir C:\Windows\System32\drivers\pgnpf.sys
```

If it is missing, **reinstall the Agent** — do not copy the file from another device.

## Start the driver

**Cmd**

```cmd
sc start PGNPF
```

Confirm with `sc query PGNPF` (expect `STATE : 4 RUNNING`), then restart the Agent
service or reboot so the Agent re-connects. The Agent should then report
**Winpcap Driver OK**.

## Register, reset, and remove the service

`pgnpf.sys` is the driver file; **PGNPF** is the service that loads it. If the file is
present but the service is missing, register it:

**Cmd**

```cmd
sc create PGNPF type= kernel start= demand error= normal binPath= System32\drivers\pgnpf.sys DisplayName= "PerformanceGuard Packet Capture Driver"
sc start PGNPF
```

> Note the space **after** each `=` (`type= kernel`, not `type=kernel`) — required by `sc`.

**Clean re-registration** (if the service is misconfigured):

**Cmd**

```cmd
sc stop PGNPF
sc delete PGNPF
sc create PGNPF type= kernel start= demand error= normal binPath= System32\drivers\pgnpf.sys DisplayName= "PerformanceGuard Packet Capture Driver"
sc start PGNPF
```

`sc delete` removes only the service entry, not the file. Repairing/reinstalling the
Agent also re-creates the service automatically.

## Diagnose problems

| Symptom | Cause | Action |
|---|---|---|
| `sc query` → *service does not exist* | Not registered. | Register (**Register, reset, and remove the service**) or reinstall. |
| `dir pgnpf.sys` → *File Not Found* | File missing. | Reinstall the Agent. |
| `sc start` → **Error 2** | Service points to a missing file. | Verify file; re-register (**Register, reset, and remove the service**). |
| `sc start` → **Error 5** | Prompt not elevated. | Reopen as administrator. |
| `sc start` → **Error 577 / 1275** | Windows blocked the driver signature / policy. | Check Secure Boot & Memory Integrity (below). |
| `STATE : 4 RUNNING` but Agent still fails | Agent not re-connected. | Restart the Agent service or reboot. |

Useful checks:

**Cmd**

```cmd
sc qc PGNPF
```

`BINARY_PATH_NAME` should point to `System32\drivers\pgnpf.sys`. Driver load failures
are also logged in **Event Viewer → Windows Logs → System** (source *Service Control
Manager*).

**If it still will not start:** on some devices **Secure Boot** or **Memory Integrity
(Core Isolation)** blocks the driver from loading. Have your Windows administrator
review these settings, then reboot. If the problem persists, send the output of
`sc query PGNPF` and `sc qc PGNPF` plus the Agent status to PerformanceGuard support.