Find Virtual Switch Packet Extensions in Regedit

This article explains how to locate registered virtual switch packet extensions for network inspection within the Windows Registry. Hyper-V Extensible Switch extensions—including capturing, filtering, and forwarding extensions—register specific configuration data in the Windows Registry to integrate with the virtualized networking stack. Below is the direct registry path and instructions for identifying these extensions.

Registry Location for Virtual Switch Extensions

To find the list of registered virtual switch extensions, open the Registry Editor (regedit.exe) and navigate to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMSMP\Parameters\SwitchExtensions

In this key, each installed virtual switch extension is represented by a subkey named after the extension’s unique GUID (Globally Unique Identifier).

Secondary Class Key Location

For detailed NDIS driver information associated with switch extensions, inspect the network service class location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e974-e325-11ce-bfc1-08002be10318}

Under this key, browse the numbered subkeys (e.g., 0000, 0001) to locate drivers where the Characteristics or ComponentId matches your packet inspection or NDIS filter driver.

Identifying Extension Details

When viewing an extension’s GUID subkey under the SwitchExtensions registry path, look for the following values to identify its functionality:

• FriendlyName / ExtensionName: The human-readable name of the extension (e.g., Microsoft NDIS Capture, Windows Filtering Platform).
• ExtensionType: An integer or string indicating whether the extension operates as a Capture (Monitoring), Filter, or Forwarding extension. Network inspection tools typically register as Capture (Monitoring) or Filter extensions.
• ComponentId: The driver service name used by the operating system to bind the extension to Hyper-V virtual switches.

Verifying via PowerShell

If you need to cross-reference registry findings directly through the operating system without manual registry navigation, run the following command in an administrative PowerShell terminal:

Get-VMSwitchExtension

To filter specifically for monitoring and inspection extensions, execute:

Get-VMSwitchExtension | Where-Object { $_.ExtensionType -eq "Monitoring" -or $_.ExtensionType -eq "Filter" }