WinDivert is a powerful user-mode capture/sniffing/modification/blocking/re-injection package for -Windows 7, Windows 8 and Windows 10. +Windows 8 and Windows 10, as well as Windows Server 2012/2016/2019. WinDivert can be used to implement user-mode packet filters, packet sniffers, firewalls, NAT, VPNs, tunneling applications, etc., without the need to write kernel-mode code. @@ -116,25 +119,26 @@ The source code for WinDivert is available for download at: To build the WinDivert drivers from source:
-wddk-build.bat +msvc-build.bat-This will build the
install\WDDK\i386\WinDivert32.sys driver.wddk-build.bat command to build the
-install\WDDK\amd64\WinDivert64.sys driver.install\MSVC\i386\WinDivert32.sys and
+install\WDDK\amd64\WinDivert64.sys drivers.
-To build the WinDivert user-mode library (WinDivert.dll) and sample
-programs:
+Note that the msvc-build.bat script will also build the
+WinDivert.dll and sample programs.
+However, these versions are not used in the official distribution
+because of the dependency on the Visual Studio 2015 C runtime.
+
+To build the (dependency free) WinDivert user-mode library
+(WinDivert.dll) and sample programs:
wddk-build.bat command described above.
@@ -272,6 +276,7 @@ typedef enum
WINDIVERT_LAYER_FLOW,
WINDIVERT_LAYER_SOCKET,
WINDIVERT_LAYER_REFLECT,
+ WINDIVERT_LAYER_ETHERNET,
} WINDIVERT_LAYER, *PWINDIVERT_LAYER;
@@ -311,6 +316,15 @@ PID?
WINDIVERT_LAYER_ETHERNET
+WINDIVERT_LAYER_NETWORK
-The WINDIVERT_LAYER_NETWORK and
-WINDIVERT_LAYER_NETWORK_FORWARD
-layers allow the user application to capture/block/inject network packets
+The WINDIVERT_LAYER_ETHERNET
+layer allows the user application to capture/block/inject ethernet
+frames passing to/from the local machine.
+An ethernet frame will start with ethernet header,
+followed by a packet from an upper layer protocol, such as
+IPv4, IPv6, ARP, etc.
+
+The WINDIVERT_LAYER_NETWORK (and
+WINDIVERT_LAYER_NETWORK_FORWARD)
+layers allow the user application to
+capture/block/inject network packets
passing to/from (and through) the local machine.
-Due to technical limitations, process ID information is not available
-at these layers.
+Network layer packets start with either an IPv4 or IPv6 header,
+typically followed by a transport layer payload (e.g., TCP or UDP).
The WINDIVERT_LAYER_FLOW layer captures information about
@@ -393,8 +416,10 @@ The WINDIVERT_LAYER_SOCKET layer can capture or block events
corresponding to socket operations, such as bind(),
connect(), listen(), etc., or the termination
of socket operations, such as a TCP socket disconnection.
-Unlike the flow layer, most socket-related events can be blocked.
-However, it is not possible to inject new or modified socket events.
+Unlike the flow layer, most socket-related events can be blocked,
+but it is not possible to inject new or modified socket events.
+Some events at this layer may be implicit, meaning that the event
+does not correspond to an explicit call to a WinSock2 function.
Process ID information (of the process responsible for the socket operation)
is available at this layer.
Due to technical limitations, this layer cannot capture events that
@@ -434,6 +459,7 @@ typedef enum
WINDIVERT_EVENT_SOCKET_CLOSE,
WINDIVERT_EVENT_REFLECT_OPEN,
WINDIVERT_EVENT_REFLECT_CLOSE,
+ WINDIVERT_EVENT_ETHERNET_FRAME,
} WINDIVERT_EVENT, *PWINDIVERT_EVENT;
+WINDIVERT_LAYER_ETHERNET:
+Only a single event is supported:
+
| Event | +Description | +
|---|---|
+WINDIVERT_EVENT_ETHERNET_FRAME
+ |
++A new ethernet frame. + | +
WINDIVERT_LAYER_NETWORK and
WINDIVERT_LAYER_NETWORK_FORWARD:
Only a single event is supported:
@@ -464,8 +511,6 @@ A new network packet.
-
@@ -585,6 +630,12 @@ An old WinDivert handle was closed.
5.3 WINDIVERT_ADDRESS
+typedef struct
+{
+ UINT32 IfIdx;
+ UINT32 SubIfIdx;
+} WINDIVERT_DATA_ETHERNET, *PWINDIVERT_DATA_ETHERNET;
+
typedef struct
{
UINT32 IfIdx;
@@ -627,22 +678,24 @@ typedef struct
typedef struct
{
INT64 Timestamp;
- UINT64 Layer:8;
- UINT64 Event:8;
- UINT64 Sniffed:1;
- UINT64 Outbound:1;
- UINT64 Loopback:1;
- UINT64 Impostor:1;
- UINT64 IPv6:1;
- UINT64 IPChecksum:1;
- UINT64 TCPChecksum:1;
- UINT64 UDPChecksum:1;
+ UINT32 Layer:8;
+ UINT32 Event:8;
+ UINT32 Sniffed:1;
+ UINT32 Outbound:1;
+ UINT32 Loopback:1;
+ UINT32 Impostor:1;
+ UINT32 IPv6:1;
+ UINT32 IPChecksum:1;
+ UINT32 TCPChecksum:1;
+ UINT32 UDPChecksum:1;
+ UINT32 Length:20;
union
{
- WINDIVERT_DATA_NETWORK Network;
- WINDIVERT_DATA_FLOW Flow;
- WINDIVERT_DATA_SOCKET Socket;
- WINDIVERT_DATA_REFLECT Reflect;
+ WINDIVERT_DATA_ETHERNET Ethernet;
+ WINDIVERT_DATA_NETWORK Network;
+ WINDIVERT_DATA_FLOW Flow;
+ WINDIVERT_DATA_SOCKET Socket;
+ WINDIVERT_DATA_REFLECT Reflect;
};
} WINDIVERT_ADDRESS, *PWINDIVERT_ADDRESS;
@@ -669,6 +722,11 @@ valid, 0 otherwise.
valid, 0 otherwise.
UDPChecksum: Set to 1 if the UDP checksum is
valid, 0 otherwise.Length: Set to the length of the packet.Ethernet.IfIdx: The interface index on which the frame
+ arrived (for inbound frames), or is to be sent (for outbound frames).Ethernet.SubIfIdx: The sub-interface index for
+ IfIdx.Network.IfIdx: The interface index on which the packet arrived
(for inbound packets), or is to be sent (for outbound packets).Network.SubIfIdx: The sub-interface index for IfIdx.
+The
+The
The
The | ||
-WINDIVERT_LAYER_NETWORK = 0
+WINDIVERT_LAYER_ETHERNET
+ |
++Ethernet frames to/from the local machine. + | +|
+WINDIVERT_LAYER_NETWORK
|
Network packets to/from the local machine. -This is the default layer. | |
+WINDIVERT_LAYER_ETHERNET
+ |
++✔ + | ++Ethernet frame. + | +
WINDIVERT_LAYER_NETWORK
|
@@ -1543,8 +1636,10 @@ modified version, or a completely new packet.
Injected packets can be captured and diverted again by other WinDivert
handles with lower priorities.
-Only the | |
+WINDIVERT_LAYER_ETHERNET
+ |
++✔ + | +|
WINDIVERT_LAYER_NETWORK
|
@@ -1597,7 +1700,8 @@ Inject? |
-For the WINDIVERT_LAYER_NETWORK layer the
+For the WINDIVERT_LAYER_ETHERNET and
+WINDIVERT_LAYER_NETWORK layers, the
pAddr->Outbound value determines which direction the packet
is injected.
If the pAddr->Outbound field is 1,
@@ -1958,7 +2062,29 @@ The WinDivert helper programming API is a collection of definitions
and functions designed to make writing WinDivert applications easier.
The use of the helper API is optional.
-6.1 WINDIVERT_IPHDR
+6.1 WINDIVERT_ETHHDR
+
+
+typedef struct
+{
+ UINT8 DstAddr[6];
+ UINT8 SrcAddr[6];
+ UINT16 Type;
+} WINDIVERT_ETHHDR, *PWINDIVERT_ETHHDR;
+
+ |
+Fields
+See here
+for more information.
+
+Remarks
+Ethernet frame header definition.
+
typedef struct @@ -2001,7 +2127,7 @@ definitions: -
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||