WinPcap manuals

WinPcap is a packet capture library for Windows that exports two sets of system calls:

• a set of low-level packet driver functions, used to send/receive packet in "raw" mode
• a set of high-level packet capture functions that have an higher degree of abstraction and that are compatible with the UNIX libpcap system calls.

Throughout this documentation we will often refer to the Packet Driver API as the first set of system calls, whereas libpcap system calls refers to the more abstract system calls that are equivalent to the ones exported by the UNIX libpcap libraries.

Programmer's manual

• How to use Libpcap (from the original Libpcap man page).
• Libpcap for Windows specific extensions
• Packet Driver API. How to use the network driver direct calls
  • Introduction
  • Packet Driver (PACKET.DLL) vs. Capture Library (libpcap)
  • Data structures
  • Functions
  • Programming tips: how to write high-performance capture programs
• Instructions and examples of how to write and compile a capture application using libpcap calls or packet driver's (PACKET.DLL) calls

Developer/Mantainer's manual

• Introduction and basic concepts on the architecture
  • Structure of the capture stack
  • BPF in Unix
  • Interaction with NDIS
• The Packet Capture Driver for Windows
  • Structure of the driver
  • The source code of the driver
  • Differences from the original BPF
• The packet capture library (pcap) for Windows
  • Introduction
  • Differences between Windows and UNIX versions of libpcap
  • Manual
  • Some words on the porting
  • libpcap and C++
  • How to use 'statistics mode'
• Performance and tests
  • Packet Capture Driver Performance
  • Tests
• Compiling the sources
  • Packet Driver
  • Libpcap