WinPcap: a Packet Capture Architecture for Windows

WinPcap is an architecture for packet capture and network analysis for the Win32 platforms, based on the model of BPF and libpcap for UNIX. It includes a kernel-level packet filter driver, a low-level dynamic link library (packet.dll), and a high-level and system-independent library (libpcap, based on version 0.4a6).

The packet capture driver is a device driver that adds to Windows 95, Windows 98, Windows NT and Windows 2000 the ability to capture and send raw packets in a way very similar to the Berkeley Packet Filter of UNIX kernels. Packet.dll is an API that can be used to access directly the functions of the BPF driver. WinPcap exports a set of primitives that are compatible with libpcap, the famous UNIX capture library. It offers a set of higher level functions to capture packets in a way independent from the underlying network hardware and operating system.

WinPcap is used by our tools WinDump and Analyzer (a network sniffer with graphical interface) to capture and handle the network traffic.

WinPcap is released under a BSD-style licence.

This work has been partially sponsored by Microsoft Research.

Release 2.02
30 Mar 2000

[Download]

[Documentation]

[FAQ]

[Compatibility]

[Credits]

[History]

[Hot Stuff]

(from 30/03/00)