Windows Packet Filter (WinpkFilter) is a high-performance transparent packet filtering and interception framework for Windows operating systems. It enables user-mode applications to capture, filter, inspect, and inject raw network packets at the NDIS layer without writing kernel-mode driver code.
API & Interface Reference
C Interface (ndisapi.h)
Low-level exported C functions for driver handle management, fast I/O initialization, network adapter enumeration, packet queuing, and kernel static filters.
Browse C API →C++ Class (CNdisApi)
High-level C++ object-oriented wrapper encapsulating driver handle lifetime, packet I/O, Fast I/O shared memory, and static filter management.
Browse C++ API →Data Structures
Kernel-to-userland IOCTL structures including intermediate packet buffers, adapter lists, static filter definitions, and fast I/O control blocks.
Browse Structures →ndisapi
Rust Interface
Safe, idiomatic Rust bindings with RAII driver lifecycle, Fast I/O packet buffers, asynchronous streaming, and typed filter flags and structures.
Browse Rust Guide →ndisapi-go
Go Interface
High-performance Go library for WinpkFilter with cgo-free direct syscall IOCTL communication, raw Ethernet packet handling, and adapter control.
Browse Go Guide →Static Filter Management
Guide to configuring in-kernel packet filtering rules, fast filter cache lookups, fragment caching, position-based insertion, and drop/pass actions.
Read Filter Guide →.NET Interface
Managed wrapper classes for C# and VB.NET applications, enabling custom packet inspection, VPN tunnels, and network security tooling on Windows.
Browse .NET API →