基于Windows200x的WDM体系的IP过滤实现技术  

Technology of IP content based on Windows200x WDM

作　　者：廖永红[1] 李洛[1] 黄战[2] 

机构地区：[1]广东轻工职业技术学院计算机工程系,广东广州510300 [2]暨南大学信息技术学院计算机科学系,广东广州510300

出　　处：《计算机工程与设计》2007年第22期5425-5427,共3页Computer Engineering and Design

摘　　要：基于内容的IP包过滤技术涉及到操作系统的内核态技术。通过对比用户态及内核态的特征,分析了Windows内核态的网络编程接口,采用了WDM的驱动程序模式体系及NDIS的层次架构。遵循IRP(I/O request packet)规范,实现了具有Miniport和Protocol层的中间驱动程序,并透明钩挂,截取、分析IP包。具体给出了Windows 200X系统中实现IP包过滤的编程技术方案。The technology of packet filter based on IP content is related to the kernel-mode of Window operation system. By comparing the characteristic ofuser-mode and kemel-mode, analyzing the network programming interface ofWindow kemel, adopting the Windows driver model （WDM） and the architecture complying with the network driver interface specification （NDIS）, the intermediate driver with miniport and protocol interface is realized according to the I/O request packet （IRP） protocol. It is transparently hooked, which intercept and analyze the IP packet. The programming solution of implementing IP packet filter is provided in WDM model of windows 200x system.

关 键 词：包过滤 驱动模式 网络驱动接口规范 过滤钩挂 内核态 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]