基于过滤器钩子驱动的数据包过滤研究与实现

Research and Implementation of Packet Filter Based on Filter-Hook Driver

在对Windows 2 0 0 0 /XP操作系统下网络过滤器钩子驱动分析基础上 ,提出了一种在Windows 2 0 0 0 /XP操作系统下网络数据包拦截技术 .该技术巧妙地将过滤器钩子挂接到系统默认的IP过滤器驱动上 ,实现数据包过滤 ,其主要依据是利用ipfiltdrv .sys所提供的功能来拦截网络数据包 .

A intercept's technology of network packet is proposed in windows 2000/XP operating system. Filter hook driver is analyzed based on working principle and realization. The technology cleverly links filter-hook to system's acquiescent IP filter-hook,Based on this,accomplish filter of packet. It's main basis that the function which is provided by ipfiltdrv.sys to intercept network packet.