WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture.
WinPcap consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. This library also contains the Windows version of the well known libpcap
Most networking applications access the network through widely used operating system primitives such as sockets. It is easy to access data on the network with this approach since the operating system copes with the low level details (protocol handling, packet reassembly, etc.) and provides a familiar interface that is similar to the one used to read and write files.
Sometimes, however, the 'easy way' is not up to the task, since some applications require direct access to packets on the network. That is, they need access to the "raw" data on the network without the interposition of protocol processing by the operating system. The purpose of WinPcap is to give this kind of access to Win32 applications.
WinPcap is:* Free.
WinPcap is released under the BSD open source licence.* High performance.
WinPcap implements all of the classic optimizations described in the packet capture literature (e.g., kernel-level filtering and buffering, context switch mitigation, partial packet copy), plus some original ones, like JIT filter compilation and kernel-level statistic processing. For these reasons, WinPcap outperforms other comparable approaches.* Popular.
WinPcap is used as the network interface by many tools -- both free and commercial including protocol analyzers, network monitors, network intrusion detection systems, sniffers, traffic generators, network testers, etc. Some of these tools, like Wireshark
are very well known in the networking community. WinPcap is downloaded thousands of times every day.* Tested and Reliable.
Many users have contributed over the years in testing WinPcap on a wide range of platforms, and in finding the most subtle bugs.* Easy to use for the final user.
WinPcap is distributed as a single small executable that runs on every supported operating system. You launch the executable, and from that moment Windows is able to capture and send raw network traffic.* Easy to use for the programmer.
Every version of WinPcap comes with a developer's pack that includes documentation, libraries and include files needed to immediately start with your own new application. The developer's pack contains a set of sample programs ready to be compiled both with Visual Studio and Cygnus, and are available as excellent starting points.* Multi-platform.
WinPcap is actively maintained on Windows NT, Windows 2000, Windows XP and Windows Server 2003. WinPcap can also work on Windows 95, Windows 98 and Windows ME, but these OSes are not maintained any longer. Windows Vista has a preliminary support, with some features disabled.* Portable.
WinPcap is completely compatible with libpcap
. This means that you can use it to port your existing Unix or Linux tools to Windows. This also means that your Windows applications will be easily portable to Unix.* Well documented.
The WinPcap manual documents the API and the internals in an easy-to-follow hyperlinked manner.