A curated catalog of open-source network software, kernel utilities, and developer components engineered by NT KERNEL and WireSock Foundation contributors.
Standalone network applications, transparent proxies, and virtual network infrastructure maintained for modern Windows, Linux, and macOS environments:
A specialized WireGuard and AmneziaWG VPN client for Windows. Features per-application split tunneling, DPI camouflage, and transparent or virtual adapter modes, both using WinpkFilter.
A transparent TCP and UDP SOCKS5 proxifier for Windows with GUI and service support. Built on WinpkFilter to route application connections through SOCKS5 proxies without app reconfiguration.
An asynchronous SOCKS5 proxy server written in Rust on Tokio. Features explicit deny-by-default access control, Dante-inspired rules, Argon2id auth, Let's Encrypt TLS, and Windows, Linux, and macOS deployment modes.
A production-grade deployment and management toolkit for AmneziaWG on Linux. Includes AWG 2.0 defaults, optional AWG 3.0/3.1 support, web management panel, and protocol-imitation obfuscation proxy (AWG 2.0).
A bounded, payload-opaque UDP relay intended primarily for WireGuard and AmneziaWG infrastructure. Forwards datagrams unchanged to fixed backends with strict session bounds and DNS refresh.
A small, auditable Cloudflare Dynamic DNS client written in Rust. Discovers public IPv4/IPv6 addresses, compares against target records, and modifies only out-of-date entries under systemd or cron.
Focused diagnostic utilities for kernel developers, network engineers, and system administrators:
Finds likely WFP callout drivers by enumerating loaded modules and inspecting their on-disk PE imports for FWPKCLNT!FwpsCalloutRegister*. Does not query the live BFE engine.
Lists IPv4 and IPv6 TCP sessions by application regular expression using IP Helper enumeration, and requests termination through Windows NSI. TCP-only; no UDP session termination.
Official language bindings, runtimes, and building blocks powering NT KERNEL networking applications:
| Component | Language / Stack | Description | Registry / Repository |
|---|---|---|---|
| Windows Packet Filter / NDISAPI | C / C++ | Core user-mode NDISAPI library and driver headers for WinpkFilter. | wiresock/ndisapi → |
| WireSock BoringTun | Rust | WireSock-maintained fork of Cloudflare BoringTun with AmneziaWG and WireSock protocol extensions. | Wiresock-Foundation/wiresock-boringtun → |
| NDISAPI .NET | C# / .NET | Managed .NET wrapper classes providing idiomatic C# APIs for WinpkFilter. | wiresock/ndisapi.net → |
| NDISAPI Rust | Rust | Safe, idiomatic Rust crate with RAII driver handles and filter builders. | crates.io/crates/ndisapi → |
| NDISAPI Go | Go | Go library providing user-mode interface to Windows Packet Filter driver. | pkg.go.dev / ndisapi-go → |
Preserved for existing users, technical researchers, and legacy Windows environments. Not actively developed for current Windows releases:
A configurable dummy virtual Ethernet network adapter driver for Windows. Registers with NDIS to provide virtual interfaces for testing, WinpkFilter packet sink endpoints, and historical network emulation without physical hardware.
A real-time Transport Driver Interface (TDI) network activity monitor and auditing utility for Windows NT 4.0 through Windows 7 / Server 2008 R2. Audited active TCP/IP connections, process IDs, and transmitted data without NDIS packet capture.
A kernel I/O request packet (IRP) monitoring and filter hooking utility for Windows NT 4.0, 2000, XP, and Server 2003. Intercepted dispatch tables, monitored filter driver attachments, and decoded SRB, URB, and IRB requests.