NDIS Filter

NDIS LWF

NDIS Lightweight Filter (LWF) driver for raw packet inspection at the network adapter level. Captures all inbound and outbound traffic before it reaches the TCP/IP stack.

Separate Driver

The NDIS filter is a separate driver from the main kernel driver. It requires its own installation via netcfg.

Overview

The NDIS filter sits between the network adapter and the protocol drivers, allowing inspection of raw Ethernet frames. Events are pushed to the main driver via IOCTL and displayed in the Network tab.

• Raw frames — Access to complete Ethernet frames
• Protocol parsing — IP, TCP, UDP, ICMP, ARP
• Flow deduplication — 1024-bucket hash table
• Direction tracking — Inbound vs outbound
• ARP monitoring — IP→MAC mapping table

Supported Protocols

Protocol	Layer	Information Captured
Ethernet	L2	Source/Dest MAC, EtherType
IPv4	L3	Source/Dest IP, Protocol, TTL
TCP	L4	Source/Dest Port, Flags, Seq/Ack
UDP	L4	Source/Dest Port, Length
ICMP	L3	Type, Code
ARP	L2	Operation, Sender/Target IP+MAC

Features

Packet Inspection

Raw Ethernet frame parsing with IP/TCP/UDP/ICMP/ARP analysis

ARP Spoof Detection

Detect ARP spoofing attacks with IP→MAC table tracking

Build & Sign

Build and sign the NDIS filter driver with expired certificate

Architecture

┌─────────────────────────────────────┐
│         User Applications           │
├─────────────────────────────────────┤
│           TCP/IP Stack              │
├─────────────────────────────────────┤
│    DioIPS NDIS Filter (LWF)  ◄──────┼── Packet inspection here
├─────────────────────────────────────┤
│         Network Adapter             │
└─────────────────────────────────────┘

Usage

Install the NDIS filter driver (see Build & Sign)
Start the DioIPS application
Navigate to the Network tab
NDIS events appear alongside WFP events
Use filters to focus on specific protocols or IPs