0
votes

as you know windows has stopped supporting raw_sockets therefore there is no real solution to use raw_sockets to build a network sniffer. so my question is how exactly Winpcap and similar libraries provide network sniffing on windows? does it depend on the version of the windows? does it use some other techniques to achieve packet sniffing? is there any other solution except raw_sockets to perform packet sniffing? some softwares such as wireshark uses winpcap to sniff network packets. raw sockets windows

1

1 Answers

3
votes

It uses NPF, which is implemented as a protocol driver. Refer to the following for a more in-depth explanation.

http://www.winpcap.org/docs/docs_412/html/group__NPF.html