- Signing Driver Signing Certificate Update: Fixed issue preventing v3.6.1 drivers from loading due to expired signing certificate.
- Bluetooth Stack Stability Fix: Resolved rare BSOD caused by NDIS OID requests referencing released memory buffers.
Windows Packet Filter Release History
Windows Packet Filter has evolved across several generations of the Windows networking stack, from the legacy NDIS driver models used on early Windows releases to the NDIS 6.x Lightweight Filter architecture used on modern Windows. The release history below represents the WinpkFilter product as a whole; architecture-specific features are identified individually where relevant.
Current Version
v3.6.2
October 2025 (Active Release)
Historical Scope
Windows 95 → Modern
Multiple Windows Generations
Driver Stack
NDIS 3 → NDIS 6.x LWF
Multiple NDIS Architectures
Production Builds
41 Releases
Continuous Product History
Version 3.x Series
- Granular Control of Static Filters: Added functions to allow precise management of static filters, including the ability to add and remove individual filters.
- Static Filters Cache: Introduced a new static filters cache on the driver level and an associated API to enable or disable it, giving you more performance and control over filter caching mechanisms.
- Packet Fragments Cache: Added a packet fragments cache on the driver level and an API for managing it, enhancing the control over packet fragmentation handling in the static filters.
- Performance Optimized Packet Processing: Upgraded the in-driver implementation of
ReadPacketsUnsorted,SendPacketsToAdaptersUnsorted, andSendPacketsToMstcpUnsorted. This optimization groups packets by their target network adapter, significantly reducing overhead and enhancing throughput.
- A major update that specifically targets performance improvements for high-speed 10 Gbps networks.
- Includes an additional API, which allows users to expand the driver’s internal packet pool, resulting in increased efficiency and performance.
- ARM64 Complete ARM64 support
- Added ICMP filter
- Updated static filter synchronization (spinlock replaced by read/write lock for Windows Vista and later)
- Significantly improved packets re-injection performance
- Added udt2tcp sample
- LWF only Fast I/O now can use up to 16 shared memory sections to read packets, significantly improving performance on high load systems
- A couple of bugs fixed in C++ samples
- ARM64 Added Windows 10 ARM64 compatibility (ARM64 driver build is available to registered customers)
- LWF only Fast I/O redesign with significantly improved performance under high load (new version uses two lock-free shared sections and no packets queuing)
- Updated C++ samples
- Bugfix: potential resource leak when having active WinpkFilter application during system power state changes
- Bugfix: incorrect reference counter could result DRIVER_POWER_STATE_FAILURE during system power state transitions
- LWF only Fast I/O performance improvements
- Fixed IRQL_UNEXPECTED_VALUE (c8) on Windows 10 1909 with ‘Killer E2200 Gigabit Ethernet Controller’
- LWF only Improved Fast I/O implementation in driver code
- Added support for NdisMediumIp
- Added compile time option to activate Jumbo frames support
- LWF only Added new experimental Fast I/O API which drastically improves packet reading latency
- Added new C++ samples
- Fixed Receive Segment Coalescing (RSC) task offload issue for wireless WDI drivers (could cause packet loss and performance degradation for some network interfaces)
- Driver signature updated (could cause installation problems on Enterprise and Server editions)
- Fixed SetAdaptersStartupMode behavior
- Fixed NdisrdRequest behaviour in WOW64 mode
- Receive Segment Coalescing (RSC) task offload issue fixed (could cause packet loss and performance degradation for some network interfaces)
- Added hardware filter change notification event API SetHwPacketFilterEvent
- Added extended validation for the parameters passed from client application to WinpkFilter drivers
- Windows 10 HLK tests passed
- RAS_LINK ProtocolBuffer size extended to 2048 bytes (Windows Vista had 600 bytes buffer, while Windows 10 has 1200 bytes)
- Fixed task offload issue specific to certain 10 Gbps network interfaces which could cause packet loss and thus network performance degradation
- Updated and slightly extended NDISAPI.DLL
- Driver Added Bluetooth media type for NDIS Lightweight Filter driver type
- Fixed Hyper-V switch issue: enabling filter driver for virtual switch and at the same time for the network interface below it, could result in incorrect send/receive operation counting and thus prevent the filter from correct detach. Under some circumstances it could result DRIVER_POWER_STATE_FAILURE.
- Fixed issue with enabled debug output in 3.2.7.1 that could negatively affect driver performance.
- Significantly improved driver performance for high speed networks
- Added special reserved pool for packets handled in kernel mode (these are packets which are not supposed to be redirected to user mode application for further processing: passed/blocked according to loaded filters and collected from non-tunneled network interfaces). This feature seriously improves remote debugging capabilities for WinpkFilter based applications. An example, if you debug over RDP and your application load static filters to pass RDP connections prior to putting network interface into the tunnel mode then you can safely put breakpoints in the packet processing thread, suspend it, analyze individual packets without a risk to be disconnected.
- Fixed Visual Studio 2015 compiler errors when building WinpkFilter NDIS 6.x Lightweight Filter drivers
- Legacy NDIS Fixed NDIS-hooking driver on Windows XP crash
- NDIS 6.x LWF Fixed issue with NDIS Lightweight Filter driver (driver bypassed some packets without analyzes in low memory resources state)
- Installer:
- Windows XP Embedded installation fix (Embedded required NDIS IM driver to be present in WINDIR)
- Silent installation support with /S switch
- Internet Gateway sample:
- Fixed packet multiplication issue caused by combination of Wireshark, loopback packet indications and single interface routing
- Driver:
- Built-in filters performance optimization
- Adapter list change event fix (removed time gap between event and actual change of the list)
- Possible memory leak issue fixed
- LWF only INF file for LWF changed to bind below and above Ethernet bridge
- Fixed incorrect field alignment in NDISHK_PACKET
- Fixed NDIS 5.1 IM DriverVerifier crash
- Fixed issue with network interface MTU configuration changes
- Fixed compatibility issue with WinGate
- Added C# Filter sample
- Fixed compatibility issues (covers but not limited to) with Cisco AnyConnect VPN, Yes Go 4G USB modem, Vodafone/HUAWEI USB modems
- Extended built-in filters:
- Added counters for incoming/outgoing packets/bytes
- Added TCP flags
- LWF only Changed approach to disable TCP task offload in NDIS LWF. Previous method had some known issues.
- Added Filter ID for the packets redirected by built-in filters
- Updated C# samples
- Updated C# samples and interface header
- LWF only Unload LWF driver hang problem fixed. As a side issue, this bug has also caused network lock with Windows Hardware Certification Kit on some systems
- Driver LWF driver updated according to Windows 8 requirements
- Added VLAN tagging 802.1Q
- Added IPv6 support for built-in filters
- Bugfixes:
- Incorrect spinlock acquire in LWF driver
- Adapter list changed event in LWF driver
- Driver Added NDIS 6.0 LightWeight Filter driver to replace NDIS 5.1 IM driver for Windows Vista/7
- Driver Bugfix for WinpkFilter NDIS IM driver on power state changes
- Driver Bugfix for WinpkFilter NDIS IM driver (BSOD on restoring from Hibernate state on Windows Vista)
- Fixed compatibility issue with Kaspersky software
- Added API for getting active WAN connections information
- Added API for sending/receiving bulk of packets. This may seriously improve performance by reducing the number of user/kernel context switches.
- Compatibility fixes in WinpkFilter API DLL and drivers
- Driver x64 driver support for 32 bit code running in WOW64. This feature should be useful for developers whose development tools does not include x64 native compiler. An example, Delphi 32-bit application can work with WinpkFilter driver on Windows x64.
- Added kernel level filters. You can load a filter table into WinpkFilter driver which defines rules for packet pass, block or redirect_and_process by your application. This may seriously improve performance.
- Added C# API interface and samples
- Changes NDISAPI.DLL required for Windows Vista support
- Installation scripts are updated to properly install drivers on Windows Vista
- Legacy NDIS Improvements/bugfixes in legacy Windows 9x/ME driver
- Changed driver exported API structures
- Visual Studio 2005 projects added for all C++ sample applications and NDISAPI.DLL
- Driver Added Windows XP x64 and Windows Server 2003 x64 support
- Extended NDISAPI.DLL
- Several bugfixes
Version 2.x Series
- Improved WinpkFilter support for some network interfaces (an example BUFFALO LPC4-CLX Fast Ethernet Adapter) under Windows 2000 and Millennium Edition
- Added MS Visual Basic 6.0 samples
- Full compatibility with Windows XP SP2
- Improved compatibility with other NDIS-hooking drivers
- New event to be signaled on network interfaces configuration changes (disable/enable network connection, unplug/plug network interface)
- New event to be signaled on WAN connection establishment/termination
Integrate Windows Packet Filter Into Your Architecture
Get production-grade packet filtering, user-mode redirection, and custom protocol processing for Windows x64 and ARM64. Download the ready-to-run SDK or license the full kernel source code for commercial deployment.