Monitoring Transport-Level Filters
For
Windows 2000 through Windows Server 2008

A Unified
Transport Data Interface (TDI)
and
Windows Filtering Platform (WFP)
Monitoring Filter Sample

October 29, 2007 - Version 2.02.06.16 released.

Background

Transport-level network filtering is performed above or within the kernel-mode TCP/IP filter driver and does not involve the lower-level NDIS machinery. In some cases, such as monitoring network traffic between a client and server on the same host, transport-level monitoring is the only viable approach.

On pre-Vista Windows platforms transport-level filtering is implemented using a Transport Data Interface (TDI) filter that is inserted above the kernel TCP/IP driver. PCAUSA has provided TDI filter samples for pre-Vista versions of Windows for many years, and one goal of this project is to seriously overhaul technology that is 'long-in-the-tooth".

An entirely new kernel-mode networking architecture is provided in Vista and later Windows platforms. On these platforms TDI is deprecated and transport-level filtering must be done using a new Windows Filtering Platform (WFP) API.

This sample unifies pre-Vista and Vista transport-level filters by providing a set of TDI and WFP monitoring filters that have common functionality and can can support a common user-mode monitoring application across platforms from Windows 2000 through Windows Server 2008.

There were several other objectives in the development of these sample drivers:

The IpPortMon Demonstration Executable

Operation of the new TDI and WFP transport-level sample drivers is illustrated by a companion application called IpPortMon that makes it simple to install the drivers and to monitor TCP streams on a specified local or remote port.

Although the purpose of IpPortMon is to allow potential customers to evaluate whether they should license the supporting TDI and WFP driver samples from PCAUSA, the application has potential use as-is in its own right.

We hope that you find it useful.

You can view an abbreviated version of the IpPortMon application User Guide by clicking here.

License and Warranty

This program is provided as-is in executable form only as a service to the Windows system software development community by Printing Communications Assoc., Inc. (PCAUSA). You may use the sample executable to evaluate the suitability of the supporting PCAUSA drivers for possible use in your own product. If the sample executable is useful as-is, then you may use your downloaded copy for your own purposes. However, PCAUSA does not grant you the right to redistribute the executables or supporting documentation in any way.

Printing Communications Assoc., Inc. (PCAUSA) expressly disclaims any warranty.

THIS SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK ARISING FROM THE USE OF THIS SOFTWARE REMAINS WITH YOU.

PCAUSA's entire liability and your exclusive remedy shall not exceed the price paid for this material. In no event shall PCAUSA or its suppliers be liable for any damages whatsoever (including, without limitation, damages for loss of business profit, business interruption, loss of business information, or any other pecuniary loss) arising out of the use or inability to use this software, even if PCAUSA has been advised of the possibility of such damages. Because some states/jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you.
 

Download the IpPortMon Demonstration Executable

Remember that...

You must be running as Administrator to be able to run the IpPortMon application. Use the "Run as..." (RAS) tool to open the Command Prompt window that you will use to run IpPortMon..

The sample IpPortMon application and supporting drivers are provided as MSI files. There are two available:

IpPortMon 32-Bit Edition - For Windows 2000 through Windows Vista x86 platforms

IpPortMon 64-Bit Edition - For Windows XP through Windows Vista x64 platforms

If you find that you cannot install IpPortMon because of missing 'C' runtime support, try downloading the setup application instead of the MSI.

IpPortMon 32-Bit Edition - For Windows 2000 through Windows Vista x86 platforms

IpPortMon 64-Bit Edition - For Windows XP through Windows Vista x64 platforms

If you find bugs in these samples or wish to suggest improvements, please let us know.

10/27/06

PCAUSA Home · Privacy Statement · Products · Ordering · Support · Utilities · Resources
Mailing Lists  · PCAUSA Newsletter · PCAUSA Discussion List
 

Rawether for Windows and WinDis 32 are trademarks of Printing Communications Assoc., Inc. (PCAUSA)
Microsoft, MS, Windows, Windows 95, Windows 98, Windows Millennium, Windows 2000, and Win32 are registered trademarks and Visual C++ and Windows NT are trademarks of the Microsoft Corporation.
Send mail to webmaster@pcausa.com with questions or comments about this web site.
Copyright © 1996-2008 Printing Communications Assoc., Inc. (PCAUSA)
Last modified: December 31, 2007