Skip to content
Switch branches/tags


Failed to load latest commit information.
Latest commit message
Commit time


Windows Packet Filter user-mode interface library



Library projects

  • ndisapi.dll - native Win32 DLL wrapper (x86/x64)
  • ndisapi.lib - native Win32 static library wrapper (x86/x64)
  • - .NET C++/CLI mixed class library (x86/x64)
  • ndisapi.vs2012 - Visual Studio 2012 project for native Win32 DLL wrapper (x86/x64). Provides support for the Windows XP/2003.
  • ndisapi.vc6 - Visual C++ 6.0 project for native Win32 DLL wrapper. Provides support for the legacy Windows versions prior Windows XP/2003.


  • capture - native C++ sample, intercepts packets for the specified network interface and saves those into the PCAP file which can be opened and analyzed with WireShark.
  • dns_proxy - native C++ sample, redirects DNS protocol through the transparent UDP proxy.
  • dnstrace - native C++ sample, intercepts DNS responses and decodes their content to the console. Has configurations to link NDISAPI statically and dynamically.
  • ethernet_bridge - native C++ sample, implements bridging wired and wireless networks. More information
  • ipv6_parser - native C++ sample, intercepts IPv6 packets, matches to originated process (using IP Helper API) parses protocol headers.
  • sni_inspector - native C++ sample, intercepts network packets and extracts SNI from HTTPS packets and Host from HTTP packets.
  • socksify - native C++ sample, redirects selected TCP connections through a SOCKS5 proxy.
  • TestDotNet - C# sample demonstrates the NDISAPI usage in several filtering scenarios. Available ion x86 and x64 configurations. AnyCPU configuration is not available due to the C++/CLI nature of wrapper (see for the workaround). Projects references PacketDotNet ( for dumping network packets headers.