Windows 中的数据包过滤（XP、7 等）
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/4978721/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Packet filtering in Windows (XP, 7 etc)
提问by Skoupidi
How can i filter (allow, deny etc) outgoing packets in Windows? I want to search in TCP or UDP packet types to find in the data segment for example this "387602304fd236e048125453b1fa10c980e9dad4fa7f3f5dd2497c2e8b2b" and drop/block/deny the packet, if it matches the search hex string. I have already tried WIPFW and PKTFILTER but they only serve IP source, dest, port etc filtering. They don't inspect the packet's data. I think Berkeley Packet Filter doe's that job, but it's for unix...
如何在 Windows 中过滤（允许、拒绝等）传出数据包？我想在 TCP 或 UDP 数据包类型中搜索以在数据段中找到例如“387602304fd236e048125453b1fa10c980e9dad4fa7f3f5dd2497c2e8b2b”并丢弃/阻止/拒绝数据包，如果它与搜索十六进制字符串匹配。我已经尝试过 WIPFW 和 PKTFILTER，但它们只提供 IP 源、目标、端口等过滤。他们不检查数据包的数据。我认为伯克利数据包过滤器确实可以完成这项工作，但它适用于 unix ......
回答by Mohammad Nikravan
Here is some to filter packet in windows:
以下是一些在 Windows 中过滤数据包的方法：
WinDivertFree open source project work on Windows 7, 2008 or upper. network layer.
WinDivert免费开源项目在 Windows 7、2008或更高版本上工作。网络层。
WinpkFilter 3.0Commercial, Windows XP and upper. datalink layer
WinpkFilter 3.0商业版，Windows XP 及更高版本。数据链路层
pcausa, Commercial. datalink layer
原因，商业。数据链路层
Windows Filtering Platform Packet Modification SampleA sample to create callout driver that WinDivert use, you should now to implement kernel driver. network layer.
Windows 过滤平台数据包修改示例创建 WinDivert 使用的标注驱动程序的示例，您现在应该实现内核驱动程序。网络层。
回答by ayush
you can use SmartSniffin windows.
您可以在 Windows 中使用SmartSniff。
Starting from version 1.10, you can filter unwanted TCP/IP activity during the capture process (Capture Filter), or when displaying the captured TCP/IP data (Display Filter)
从版本 1.10 开始，您可以在捕获过程（捕获过滤器）或显示捕获的 TCP/IP 数据时（显示过滤器）过滤不需要的 TCP/IP 活动
回答by Sorressean
You want application level filtering then, (just changing the payload). If you want to be able to drop, I know you can hook into Winsock, which will allow you to capture packets as they go out and set up a filter there. Windows seven also added to their firewall, so you could use that API to grab outbound packets; I'm not sure if it will allow you to specifically alter the payload data, though.
然后您需要应用程序级过滤（只需更改有效负载）。如果您希望能够丢弃，我知道您可以连接到 Winsock，这将允许您在数据包出去时捕获数据包并在那里设置过滤器。Windows 7 还添加了他们的防火墙，因此您可以使用该 API 来抓取出站数据包；不过，我不确定它是否允许您专门更改有效负载数据。
