How to analyze / intercept packets before sending / receiving the OS?

Question

I always wondered how software firewalls work under covers, and would like to be able to write my own tools for analyzing or intercepting packets before sending them or receiving an OS. I am familiar with the basic principles of networking; I just don't know where to start if I want to write software that fits into the network stack, similar to how firewalls do it. Can someone give me some pointers?

I would be particularly interested if this can be done using C #, but I can do other languages ​​as well. I mainly focus on Windows, but would like to know if there are cross-platform libraries there.

EDIT Using the NDIS driver (like Wireshark) sounds like a good option, and Vista's filtering options sound neat, but how do firewalls do it, say, in Windows XP? They do not need to install a special driver that I know of.

Answer 1

In Windows Vista and above, you can see the Windows Filtering Platform . In earlier versions of Windows, you need to use filter drivers (the link to the MSDN page mentions which technologies replaces WFP.)

Answer 2

, NDIS. (Network Interface Card), , NIC, - - Ethernet.

#. C ++ .

UPDATE: Windows XP. , , , API, Windows Vista .

Answer 3

, " O/S", WireShark libpcap.

Answer 4

WinPcap - NDIS . , , /, , . http://www.winpcap.org/docs/docs_40_2/html/group__internals.html:

-, , . , . , , Netgroup (NPF); Windows 95, Windows 98, Windows ME, Windows NT 4, Windows 2000 Windows XP. , . (, ftp ), - , (, , ).