Network packet capturing for Windows operating system

Today there are several network security systems used by the end users at the application layer. Network security systems are designed to detect the attacks or to measure the intensity of the network traffic. The first step for the network systems is to detect the malicious traffic coming to the network or going from the network. Detecting is possible with analyzing the packets whether they are malicious or normal network packets with the user level applications. Diagnosis tools can be created by inspecting of each packet in the network. In this study, I present the detailed methods to capture the network traffic in Windows Operating Systems. The second chapter is devoted to explain the parts of the Windows OS' kernel in charge of network. Network packet capturing process for different kind of operating systems and Winpcap used by the most popular network analysis tools are discussed in the third part of the study. The evaluations and analysis with a simulation of packet capturing are presented in the fourth chapter. A detail explanation of the network packet capturing application written in C++ programming language and future works are presented in the conclusion part. It is through network packets that computers can communicate with each other within a network. Any input from the outside world to the computer is input to the computer through a hardware device. The packages come in the same way via a computer network cable and enter the operating system from the network card. The Windows operating system restricts the operations that the user can do, unlike open source operating systems. In open source operating systems, users can interact directly with the kernel that makes up the operating system. When network packages need to be captured and analyzed, application developers place one packet capture driver in the operating system kernel and also develop new libraries to allow user-level applications to contact this driver. The speed and accuracy of network packet capture systems directly impact the applications that will analyze the network packets. Because; There may be content that will damage the system in any unreachable network package and the analysis system may not be aware of this package. The performance of network packet capture systems is directly related to the buffering and filtering systems used in the system. If a good buffer and filter are not used, many network packets are transmitted directly to the operating system without being caught. There are many network packet capture systems developed in open source operating systems. However, most of the normal and server computers used by many users and companies nowadays include the Windows operating system. Because of this, a network packet capture system was required for Windows operating system. As a result of the work done, WinPcap network packet capture library, which is preferred by many applications today, has been developed.