基于SPI和NDIS HOOK的网络数据包拦截方案研究

Research on Packet-Filter Based on NDIS-HOOK and SPI

利用NDIS HOOK与SPI相结合在Windows XP下设计了一个基于Winsock2 SPI与NDIS HOOK的网络数据包拦截方案。在应用层利用SPI进行各种应用程序的数据包的过滤,在核心层利用NDIS HOOK来过滤各种非Socket通信的数据包,实现底层的数据包的捕获,从而能更好地过滤数据。

Designed for Windows XP-based Winsock2 SPI and NDIS Hook network packet interception program.This thesis combines the NDIS-Hook with SPI.In application layer,the system uses SPI to filter all kinds of application Program.In kernel layer,the system uses NDIS-Hook to filter all kinds of non-socket data Packets.This program has good expansibility and relatively high speed.It is a kind of firewall that deserves trust of.