{"id":1974,"date":"2018-12-29T19:13:42","date_gmt":"2018-12-29T18:13:42","guid":{"rendered":"http:\/\/labalec.fr\/erwan\/?p=1974"},"modified":"2018-12-29T20:05:50","modified_gmt":"2018-12-29T19:05:50","slug":"windows-raw-sockets","status":"publish","type":"post","link":"https:\/\/labalec.fr\/erwan\/?p=1974","title":{"rendered":"Windows raw sockets"},"content":{"rendered":"

Following previous article<\/a>, I did some more googling around windows raw sockets feature and found this interesting article<\/a>.<\/p>\n

And in particular this part when weighting the pros and cons of using windows raw sockets :<\/p>\n

Since raw sockets are built into the kernel TCP\/IP implementation, there is no need for additional kernel-mode code (such as NDIS filter drivers or WFP callout drivers). There are however a number of drawbacks compared to the first two techniques:<\/em><\/p>\n

\u00b7 No filtering in kernel-mode is possible \u2013 all packets are delivered to the user-mode application (which has performance implications).<\/em><\/p>\n

\u00b7 There is no visibility of how many packets are lost\/dropped as a result of insufficient buffering.<\/em><\/p>\n

\u00b7 The packets are first time-stamped when processed by a user-mode application, which might be some time after they \u201ccould have been\u201d time-stamped by filter\/callout driver kernel-mode code running in a DPC (Deferred Procedure Call).<\/em><\/p>\n

\u00b7 There is no guarantee of the order in which the kernel adds packets to the raw socket. Monitoring the kernel activity with the \u201cMicrosoft-Windows-TCPIP\u201d and \u201cMicrosoft-Windows-Winsock-AFD\u201d providers indicates that the outbound response to an inbound packet is often copied to the raw socket before the inbound packet.<\/em><\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"

Following previous article, I did some more googling around windows raw sockets feature and found this interesting article. And in particular this part when weighting the pros and cons of using windows raw sockets : Since raw sockets are built into the kernel TCP\/IP implementation, there is no need for additional kernel-mode code (such as […]<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1974","post","type-post","status-publish","format-standard","hentry","category-network","category-5-id","post-seq-1","post-parity-odd","meta-position-corners","fix"],"_links":{"self":[{"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/posts\/1974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1974"}],"version-history":[{"count":2,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/posts\/1974\/revisions"}],"predecessor-version":[{"id":1978,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=\/wp\/v2\/posts\/1974\/revisions\/1978"}],"wp:attachment":[{"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/labalec.fr\/erwan\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}