论文部分内容阅读
Winpcap的组成及工作原理Winpcap主要有以下几个部分组成的:⑴内核级包裹过滤驱动程序(基于BPF);⑵一个低级链接库(packet.dll);⑶一个高级链接库(wpcap.dll)。在上述的三个部件中,包裹过滤驱动程序是加在Windows操作系统上用来提供捕获原始网络包的功能;而packet.dll为用户提供了网络包捕获程序的接口。它是由一系列函数组成,使得用户与驱动的通信变得更加简单,它避免了在用户程序中进行系统调用,并且
Winpcap composition and working principle Winpcap mainly consists of the following components: ⑴ kernel-level package filtering driver (based on BPF); ⑵ a low-level link library (packet.dll); ⑶ an advanced link library (wpcap.dll). Among the three components above, the wrapper filter driver is added to the Windows operating system to provide the ability to capture the original network packet; packet.dll provides the user with the interface to the network packet capture program. It consists of a series of functions that make it easier for users to communicate with the driver, avoiding system calls in the user program, and