repository·master·Indexed 19 days ago
https://github.com/wiresock/ndisapiA user-mode library providing a safe and efficient interface for interacting with the Windows Packet Filter driver. It enables raw network packet inspection, modification, and transmission at the NDIS level, featuring tools for packet filtering via fastio_packet_filter, UDP redirection with udp_proxy_server, and IPv6 header parsing.
The PcapPlusPlus Demo is a tool designed to intercept and analyze network traffic. Its primary capabilities include:
The Hyperscan example application demonstrates how to integrate the Hyperscan and llhttp libraries for high-performance network monitoring.
Workflow:
llhttp to the detected sessions for in-depth HTTP protocol parsing.This is useful for network security and monitoring applications that need to identify and analyze HTTP traffic at scale.
NDISAPI is a user-mode interface library for interacting with the Windows Packet Filter (WinpkFilter) driver. It allows developers to perform network packet filtering (inspection and modification) at the NDIS level of the Windows network stack without requiring kernel-mode programming skills.
Key capabilities include:
The sni_inspector is a C++ utility designed to intercept and analyze network traffic using the Windows Packet Filter (WinpkFilter) driver. It specifically inspects TLS/SSL connections to extract the Server Name Indication (SNI) extension and parses HTTP packets to extract the Host header.
Workflow:
WinpkFilter driver is loaded.dnstrace application is a C++ console tool designed for network debugging, security monitoring, and research. It provides a detailed trace of DNS responses by parsing the structure of DNS packets. It serves as a practical demonstration of how to link the NDISAPI library both statically and dynamically.The application functions as a bidirectional converter using the Windows Packet Filter (WinpkFilter) library to intercept and modify network traffic. It utilizes a simple_packet_filter object configured with two primary lambda functions to handle packet redirection:
ndisapi::fastio_packet_filter can be used to intercept IPv6 packets. Once intercepted, these packets can be passed to an ipv6_parser to identify the transport protocol and perform subsequent actions, such as process lookups for TCP traffic.Windows Packet Filter. Once captured, the tool parses the packets to extract IP, UDP, and DNS headers. For every DNS response identified, it extracts and prints the specific DNS record type and its associated data. The process runs continuously until interrupted by the user.The Hyperscan example is optimized for high-quality, reliable connections. It is not engineered to handle:
Performance may be suboptimal on unreliable network connections.
The Rebind example demonstrates how to use the Windows Packet Filter driver to redirect outgoing TCP/UDP traffic for a specific application from a default network interface to a different one.
Execute the application from the command line. If the Windows Packet Filter driver is active, the application will prompt you to select a network interface from a displayed list. Enter the number corresponding to the interface you wish to monitor to begin capturing and parsing DNS responses.
./dnstraceBefore building or running the PcapPlusPlus Demo, ensure the following requirements are met:
Windows Packet Filter driver must be loaded on your system to allow the application to intercept network packets.vcpkg using the appropriate static triplet (x86-windows-static or x64-windows-static).