WinPcap Packet-Capture Driver

For administrators troubleshooting network measurement on a Windows endpoint. All commands below require an elevated Command Prompt (Run as administrator).

How the driver works

The Agent measures network performance by capturing network traffic. Capture relies on three parts:

Component	Type	Role
`PGwpcap.dll`	User-mode library	The capture API the Agent calls.
PGNPF	Windows service	Tells Windows to load the driver file.
`C:\Windows\System32\drivers\pgnpf.sys`	Kernel driver file	Captures packets from the network adapter.

The Agent loads PGwpcap.dll, which connects to the PGNPF service, which loads pgnpf.sys. A working setup needs the file on disk and the service running. The Agent installer places pgnpf.sys on disk; the PGNPF service is created and started automatically the first time the Agent captures.

If the driver is not running, the Agent still runs but network measurement is unavailable.

Driver status in the Agent information

Message	Meaning	Action
Winpcap Driver OK	Driver loaded, capture working.	None.
Winpcap Driver Could not Initialize	Agent could not connect to the driver.	Check and start the driver (below).

Common causes of the warning: the PGNPF service is stopped, the driver was not installed, or Windows security settings block it.

Check the driver

sc query PGNPF

Look at the STATE line:

Result	Meaning	Action
`STATE : 4 RUNNING`	Loaded and running.	None. If the Agent still complains, restart the Agent service.
`STATE : 1 STOPPED`	Installed but not running.	Start it (Start the driver).
service does not exist	Not registered.	Register it (Register, reset, and remove the service) or reinstall the Agent.

Also confirm the file exists:

dir C:\Windows\System32\drivers\pgnpf.sys

If it is missing, reinstall the Agent — do not copy the file from another device.

Start the driver

sc start PGNPF

Confirm with sc query PGNPF (expect STATE : 4 RUNNING), then restart the Agent service or reboot so the Agent re-connects. The Agent should then report Winpcap Driver OK.

Register, reset, and remove the service

pgnpf.sys is the driver file; PGNPF is the service that loads it. If the file is present but the service is missing, register it:

sc create PGNPF type= kernel start= demand error= normal binPath= System32\drivers\pgnpf.sys DisplayName= "PerformanceGuard Packet Capture Driver"
sc start PGNPF

Note the space after each = (type= kernel, not type=kernel) — required by sc.

Clean re-registration (if the service is misconfigured):

sc stop PGNPF
sc delete PGNPF
sc create PGNPF type= kernel start= demand error= normal binPath= System32\drivers\pgnpf.sys DisplayName= "PerformanceGuard Packet Capture Driver"
sc start PGNPF

sc delete removes only the service entry, not the file. Repairing/reinstalling the Agent also re-creates the service automatically.

Diagnose problems

Symptom	Cause	Action
`sc query` → service does not exist	Not registered.	Register (Register, reset, and remove the service) or reinstall.
`dir pgnpf.sys` → File Not Found	File missing.	Reinstall the Agent.
`sc start` → Error 2	Service points to a missing file.	Verify file; re-register (Register, reset, and remove the service).
`sc start` → Error 5	Prompt not elevated.	Reopen as administrator.
`sc start` → Error 577 / 1275	Windows blocked the driver signature / policy.	Check Secure Boot & Memory Integrity (below).
`STATE : 4 RUNNING` but Agent still fails	Agent not re-connected.	Restart the Agent service or reboot.

Useful checks:

sc qc PGNPF

BINARY_PATH_NAME should point to System32\drivers\pgnpf.sys. Driver load failures are also logged in Event Viewer → Windows Logs → System (source Service Control Manager).

If it still will not start: on some devices Secure Boot or Memory Integrity (Core Isolation) blocks the driver from loading. Have your Windows administrator review these settings, then reboot. If the problem persists, send the output of sc query PGNPF and sc qc PGNPF plus the Agent status to PerformanceGuard support.