【摘要】 文中就 Windows系列平台下常用的监测实现技术进行了讨论 ,包括应用层实现的 Winsock服务提供者接口 ( SPI)和原始套接字 ,以及系统核心层实现的传输层过滤驱动程序、过滤器钩子( Filter-Hook)驱动程序、中间驱动程序 ( IMP)、NDIS HOOK驱动程序等不同的实现方法及其特点 ,在此基础上详细论述了中间驱动程序的实现更多还原

【Abstract】 Network monitoring has the functions of overseeing and analyzing users’ behaviors, finding network leaks and detecting network performance, which will make administrator effectively lookout, audit and evaluate his own system. This paper outlines frequent monitoring implementation techniques based on a series of windows platform, including windows service provider interface(SPI), original socket, filter driver on transport layer, Filter-Hook driver,InterMedial Driver(IMP),NDIS HOOK Driver.更多还原