Windows Packet Filter

Windows Packet Filter (WinpkFilter) is a high-performance packet filtering framework for Windows that allows developers to transparently filter (view and modify) raw network packets at the NDIS level of the network stack with minimal impact on network activity and without having to write low-level kernel driver code.

Operating System Compatibility

Windows Packet Filter is actively tested and maintained on all current Windows releases:

  • Desktop: Windows 11, Windows 10 (x64, ARM64, x86)
  • Server: Windows Server 2025, Windows Server 2022, 2019, 2016
  • Legacy Platforms: Windows 7, 8, 8.1, Vista, XP, and legacy Windows 9x/ME/NT lineages remain supported via historical driver releases.

Primary Operating Modes

  • Tunnel Mode (Filter): Intercepts packets and diverts them to user mode for processing, modification, or dropping.
  • Listen Mode (Passive Tap): Passes packets normally while delivering copies to user mode for sniffing and protocol analysis.
  • Kernel Static Filtering: Evaluates filter rules entirely in kernel mode within ndisrd.sys with flow-level caching for maximum line-rate throughput.