WindivertDotnet

https://github.com/xljiulang/windivertdotnet
Admin
WindivertDotnet is an object-oriented async wrapper for WinDivert that enables easy network packet...
Tokens:6,668
Snippets:34
Trust Score:9.4
Update:6 months ago
Show doc for...
Tokens:
Raw
### Using WinDivertLayer for Network Layers

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

Demonstrates how to instantiate WinDivert with different WinDivertLayer values to capture packets at various network levels. Requires administrator privileges.

```csharp
using WindivertDotnet;

// Network 层 - 拦截传入/传出本地计算机的网络数据包
using var networkDivert = new WinDivert(Filter.True, WinDivertLayer.Network);

// Forward 层 - 拦截通过本地计算机转发的数据包 (需要启用IP转发)
using var forwardDivert = new WinDivert(Filter.True, WinDivertLayer.Forward);

// Flow 层 - 监控网络流的建立和删除事件 (只读)
var flowFilter = Filter.True.And(f => f.Flow.LocalPort == 80);
using var flowDivert = new WinDivert(flowFilter, WinDivertLayer.Flow);

// Socket 层 - 监控套接字操作事件 (只读)
var socketFilter = Filter.True.And(f => f.Socket.ProcessId == 1234);
using var socketDivert = new WinDivert(socketFilter, WinDivertLayer.Socket);

// Reflect 层 - 监控其他 WinDivert 句柄的操作 (只读)
using var reflectDivert = new WinDivert(Filter.True, WinDivertLayer.Reflect);
```

--------------------------------

### Working with Protocol Header Structures

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

Shows how to create and populate protocol header structures like IPV4Header, TcpHeader, UdpHeader, and IcmpV4Header. Ensure checksums are recalculated after modifications using CalcChecksums().

```csharp
using WindivertDotnet;
using System.Net;
using System.Net.Sockets;

unsafe void DemoHeaders()
{
    // IPv4 头
    var ipv4 = new IPV4Header
    {
        Version = IPVersion.V4,
        HdrLength = 5,           // 20字节 (5 * 4)
        TOS = 0,                 // 服务类型
        Length = 40,             // 总长度
        Id = 12345,              // 报文ID
        FragmentFlags = FragmentFlag.None,
        FragmentOffset = 0,
        TTL = 64,                // 生存时间
        Protocol = ProtocolType.Tcp,
        SrcAddr = IPAddress.Parse("192.168.1.1"),
        DstAddr = IPAddress.Parse("192.168.1.2")
        // Checksum 由 CalcChecksums 自动计算
    };

    // TCP 头
    var tcp = new TcpHeader
    {
        SrcPort = 12345,
        DstPort = 80,
        SeqNum = 1000,
        AckNum = 0,
        HdrLength = 5,           // 20字节 (5 * 4)
        Syn = true,              // SYN 标志
        Ack = false,
        Fin = false,
        Rst = false,
        Psh = false,
        Urg = false,
        Window = 65535
        // Checksum 由 CalcChecksums 自动计算
    };

    // UDP 头
    var udp = new UdpHeader
    {
        SrcPort = 12345,
        DstPort = 53,
        Length = 20              // 头部8字节 + 数据
    };

    // ICMP v4 头
    var icmp = new IcmpV4Header
    {
        Type = IcmpV4MessageType.EchoRequest,
        Code = default,
        Identifier = 1,
        SequenceNumber = 1
    };
}
```

--------------------------------

### Inject Custom Packets (ICMP Echo Request)

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

Demonstrates constructing and injecting an ICMP Echo Request packet from scratch. Use WinDivertRouter to calculate local addresses and routing information before creating the packet. Ensure checksums are calculated for newly created packets.

```csharp
using WindivertDotnet;
using System.Net;
using System.Net.Sockets;

// 使用任意过滤器打开 WinDivert (发送不需要匹配过滤器)
using var divert = new WinDivert(Filter.True, WinDivertLayer.Network);

async Task SendPingAsync(IPAddress dstAddr)
{
    // 使用 router 计算本机地址和路由信息
    var router = new WinDivertRouter(dstAddr);
    using var addr = router.CreateAddress();

    // 创建 ICMP Echo 请求包
    using var packet = CreateIcmpEchoPacket(router.SrcAddress, router.DstAddress);

    // 计算校验和 - 新创建的包必须计算
    packet.CalcChecksums(addr);

    // 发送数据包
    await divert.SendAsync(packet, addr);
    Console.WriteLine($"已发送 Ping 到 {dstAddr}");
}

unsafe WinDivertPacket CreateIcmpEchoPacket(IPAddress srcAddr, IPAddress dstAddr)
{
    // 构造 IPv4 头
    var ipHeader = new IPV4Header
    {
        Version = IPVersion.V4,
        HdrLength = (byte)(sizeof(IPV4Header) / 4),  // 以4字节为单位
        TTL = 64,
        Protocol = ProtocolType.Icmp,
        Id = 1234,
        SrcAddr = srcAddr,
        DstAddr = dstAddr,
        Length = (ushort)(sizeof(IPV4Header) + sizeof(IcmpV4Header))
    };

    // 构造 ICMP 头
    var icmpHeader = new IcmpV4Header
    {
        Type = IcmpV4MessageType.EchoRequest,
        Code = default,
        Identifier = 1,
        SequenceNumber = 1
    };

    // 创建数据包并写入数据
    var packet = new WinDivertPacket(ipHeader.Length);
    var writer = packet.GetWriter();
    writer.Write(ipHeader);
    writer.Write(icmpHeader);

    return packet;
}

// 发送 Ping
await SendPingAsync(IPAddress.Parse("8.8.8.8"));
```

--------------------------------

### Add WindivertDotnet NuGet Package

Source: https://github.com/xljiulang/windivertdotnet/blob/master/README.md

Add the WindivertDotnet NuGet package to your project to use its functionalities.

```xml
<PackageReference Include="WindivertDotnet" Version="1.*" /> 

```

--------------------------------

### Implement Batch Ping with WindivertDotnet

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

Uses WinDivert to filter inbound ICMP Echo Replies and send outbound Echo Requests. Requires the WindivertDotnet library and appropriate system privileges for network packet manipulation.

```csharp
using WindivertDotnet;
using System.Net;
using System.Collections.Generic;

public static class FastPinger
{
    public static async Task<IPAddress[]> PingAllAsync(
        IEnumerable<IPAddress> targets,
        TimeSpan waitTime,
        CancellationToken cancellationToken = default)
    {
        // 过滤器: 仅匹配入站的 ICMP Echo Reply
        var filter = Filter.True
            .And(f => f.Network.Inbound)
            .And(f => f.ICmp.Type == IcmpV4MessageType.EchoReply
                  || f.IcmpV6.Type == IcmpV6MessageType.EchoReply);

        using var divert = new WinDivert(filter, WinDivertLayer.Network);
        var respondedAddresses = new List<IPAddress>();
        var sentSeqNums = new HashSet<ushort>();

        // 启动接收任务
        using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
        var receiveTask = ReceiveRepliesAsync(divert, respondedAddresses, sentSeqNums, cts.Token);

        // 发送所有 Ping 请求
        ushort seqNum = 0;
        foreach (var target in targets)
        {
            try
            {
                var router = new WinDivertRouter(target);
                using var addr = router.CreateAddress();
                using var packet = CreatePingPacket(router, ++seqNum);
                packet.CalcChecksums(addr);

                await divert.SendAsync(packet, addr, cancellationToken);
                sentSeqNums.Add(seqNum);
            }
            catch { /* 忽略无法路由的地址 */ }
        }

        // 等待响应
        await Task.Delay(waitTime, cancellationToken).ConfigureAwait(ConfigureAwaitOptions.SuppressThrowing);
        cts.Cancel();

        try { await receiveTask; } catch (OperationCanceledException) { }

        return respondedAddresses.Distinct().ToArray();
    }

    private static async Task ReceiveRepliesAsync(
        WinDivert divert,
        List<IPAddress> results,
        HashSet<ushort> validSeqNums,
        CancellationToken cancellationToken)
    {
        using var packet = new WinDivertPacket();
        using var addr = new WinDivertAddress();

        while (!cancellationToken.IsCancellationRequested)
        {
            try
            {
                await divert.RecvAsync(packet, addr, cancellationToken);

                unsafe
                {
                    var result = packet.GetParseResult();
                    IPAddress? srcAddr = result.IPV4Header != null
                        ? result.IPV4Header->SrcAddr
                        : result.IPV6Header?.SrcAddr;

                    ushort seqNum = result.IcmpV4Header != null
                        ? result.IcmpV4Header->SequenceNumber
                        : result.IcmpV6Header->SequenceNumber;

                    if (srcAddr != null && validSeqNums.Contains(seqNum))
                    {
                        results.Add(srcAddr);
                    }
                }

                // 转发数据包
                await divert.SendAsync(packet, addr, cancellationToken);
            }
            catch (OperationCanceledException) { break; }
        }
    }

    private static unsafe WinDivertPacket CreatePingPacket(WinDivertRouter router, ushort seqNum)
    {
        var ipHeader = new IPV4Header
        {
            Version = IPVersion.V4,
            HdrLength = (byte)(sizeof(IPV4Header) / 4),
            TTL = 64,
            Protocol = System.Net.Sockets.ProtocolType.Icmp,
            Id = seqNum,
            SrcAddr = router.SrcAddress,
            DstAddr = router.DstAddress,
            Length = (ushort)(sizeof(IPV4Header) + sizeof(IcmpV4Header))
        };

        var icmpHeader = new IcmpV4Header
        {
            Type = IcmpV4MessageType.EchoRequest,
            Identifier = 1,
            SequenceNumber = seqNum
        };

        var packet = new WinDivertPacket(ipHeader.Length);
        var writer = packet.GetWriter();
        writer.Write(ipHeader);
        writer.Write(icmpHeader);

        return packet;
    }
}

// 使用示例
var targets = new[]
{
    IPAddress.Parse("8.8.8.8"),
    IPAddress.Parse("1.1.1.1"),
    IPAddress.Parse("114.114.114.114")
};

var respondedIPs = await FastPinger.PingAllAsync(targets, TimeSpan.FromSeconds(2));
Console.WriteLine($"响应的IP: {string.Join(", ", respondedIPs)}");
```

--------------------------------

### Build Network Packet Filters with Filter Class

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

Use the Filter class for type-safe, LINQ-style expression building to define network packet filtering rules. Combine conditions using And() and Or() methods to generate WinDivert filter strings.

```csharp
using WindivertDotnet;

// 创建基础过滤器 - 匹配所有包
var filterAll = Filter.True;

// 创建复杂的过滤器组合
// 匹配：回环地址 + TCP协议 + 目标端口443 + ACK标志位
var httpsFilter = Filter.True
    .And(f => f.Network.Loopback)
    .And(f => f.Tcp.DstPort == 443)
    .And(f => f.Tcp.Ack == true);

// 匹配入站的 HTTP/HTTPS 流量
var webFilter = Filter.True
    .And(f => f.Network.Inbound)
    .And(f => f.Tcp.DstPort == 80 || f.Tcp.DstPort == 443);

// 匹配 ICMP Echo 请求或回复
var icmpFilter = Filter.True
    .And(f => f.IsIcmp)
    .And(f => f.ICmp.Type == IcmpV4MessageType.EchoRequest
          || f.ICmp.Type == IcmpV4MessageType.EchoReply);

// 匹配特定IP地址的流量
var ipFilter = Filter.True
    .And(f => f.IP.SrcAddr == "192.168.1.100" || f.IP.DstAddr == "192.168.1.100");

// 使用 Or 逻辑组合
var tcpOrUdpFilter = Filter.True
    .And(f => f.IsTcp)
    .Or(f => f.IsUdp);

// 输出过滤器字符串
Console.WriteLine(httpsFilter.ToString());
// 输出: ((loopback and (tcp.DstPort == 443)) and tcp.Ack)
```

--------------------------------

### Reverse Source and Destination Addresses

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

Uses the `ReverseEndPoint()` method to quickly swap source and destination addresses/ports, commonly used for constructing response packets. Remember to flip the outbound flag and recalculate checksums after reversing endpoints.

```csharp
using WindivertDotnet;

var filter = Filter.True.And(f => f.Tcp.DstPort == 80);
using var divert = new WinDivert(filter, WinDivertLayer.Network);
using var packet = new WinDivertPacket();
using var addr = new WinDivertAddress();

await divert.RecvAsync(packet, addr);

// 翻转源和目标 - 交换 IP 地址和端口
// IPv4/IPv6 的 SrcAddr <-> DstAddr
// TCP/UDP 的 SrcPort <-> DstPort
bool success = packet.ReverseEndPoint();

if (success)
{
    // 翻转地址后需要翻转出站标志
    addr.Flags ^= WinDivertAddressFlag.Outbound;

    // 重新计算校验和
    packet.CalcChecksums(addr);

    // 发送响应
    await divert.SendAsync(packet, addr);
}
```

--------------------------------

### Modify Packet and Recalculate Checksums

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

Demonstrates how to modify captured packet contents such as ports and IP addresses, and then correctly recalculate checksums before sending. Ensure checksums are recalculated after any packet modification.

```csharp
using WindivertDotnet;
using System.Net;

var filter = Filter.True
    .And(f => f.Network.Loopback)
    .And(f => f.Tcp.DstPort == 8080);

using var divert = new WinDivert(filter, WinDivertLayer.Network);
using var packet = new WinDivertPacket();
using var addr = new WinDivertAddress();

while (true)
{
    // 读取数据包
    await divert.RecvAsync(packet, addr);

    unsafe
    {
        var result = packet.GetParseResult();

        // 修改目标端口: 8080 -> 80
        if (result.TcpHeader != null)
        {
            result.TcpHeader->DstPort = 80;
        }

        // 修改目标IP地址
        if (result.IPV4Header != null)
        {
            result.IPV4Header->DstAddr = IPAddress.Parse("127.0.0.1");
        }
    }

    // 重新计算校验和 - 修改数据包后必须调用
    packet.CalcChecksums(addr);

    // 如果修改了IP地址(非对调)，需要重新计算网络接口索引
    packet.CalcNetworkIfIdx(addr);

    // 重新计算出站/回环标志
    packet.CalcLoopbackFlag(addr);

    // 发送修改后的数据包
    await divert.SendAsync(packet, addr);
}
```

--------------------------------

### Core WinDivert Operations with WinDivert Class

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

Utilize the WinDivert class to open WinDivert handles and perform packet send/receive operations. Supports both synchronous and asynchronous modes with configurable layer, priority, and flags.

```csharp
using WindivertDotnet;
using System.ComponentModel;

// 创建 WinDivert 实例 - Network 层用于拦截网络数据包
var filter = Filter.True.And(f => f.Network.Outbound && f.Tcp.DstPort == 80);

try
{
    // 参数: filter - 过滤器, layer - 工作层, priority - 优先级[-30000,30000], flags - 工作标志
    using var divert = new WinDivert(filter, WinDivertLayer.Network, priority: 0, flags: WinDivertFlag.None);

    // 查看版本信息
    Console.WriteLine($"WinDivert Version: {divert.Version}");

    // 配置队列参数(需在首次IO操作前设置)
    divert.QueueLength = 8192;           // 队列容量 [32,16384]
    divert.QueueTime = TimeSpan.FromSeconds(4);  // 自动丢包前的最短排队时长 [100ms, 16s]
    divert.QueueSize = 8 * 1024 * 1024;  // 队列最大字节数 [64KB, 32MB]

    using var packet = new WinDivertPacket();
    using var addr = new WinDivertAddress();

    // 异步接收数据包
    int recvLength = await divert.RecvAsync(packet, addr);
    Console.WriteLine($"接收到 {recvLength} 字节的数据包");

    // 异步发送数据包(转发)
    int sendLength = await divert.SendAsync(packet, addr);

    // 关闭接收/发送
    divert.Shutdown(WinDivertShutdown.Both);
}
catch (Win32Exception ex)
{
    Console.WriteLine($"WinDivert 错误: {ex.Message}");
}
```

--------------------------------

### Inject Network Packet (Echo Request)

Source: https://github.com/xljiulang/windivertdotnet/blob/master/README.md

This C# code shows how to inject an ICMP Echo Request packet into the network. It utilizes WinDivertRouter to determine local addresses and creates a custom IPv4 packet with ICMP header, calculating checksums before sending.

```csharp
private async Task SendEchoRequestAsync(IPAddress dstAddr)
{
    // 使用router计算将进行通讯的本机地址
    var router = new WinDivertRouter(dstAddr);
    using var addr = router.CreateAddress();
    using var packet = this.CreateIPV4EchoPacket(router.SrcAddress, router.DstAddress);

    packet.CalcChecksums(addr);     // 计算checksums，因为创建包时没有计算

    await this.divert.SendAsync(packet, addr);
}

/// <summary>
/// 创建icmp的echo包
/// </summary>
/// <param name="srcAddr"></param>
/// <param name="dstAddr"></param>
/// <returns></returns>
private unsafe WinDivertPacket CreateIPV4EchoPacket(IPAddress srcAddr, IPAddress dstAddr)
{
    // ipv4头
    var ipHeader = new IPV4Header
    {
        TTL = 128,
        Version =  IPVersion.V4,
        DstAddr = dstAddr,
        SrcAddr = srcAddr,
        Protocol = ProtocolType.Icmp,
        HdrLength = (byte)(sizeof(IPV4Header) / 4),
        Id = ++this.id,
        Length = (ushort)(sizeof(IPV4Header) + sizeof(IcmpV4Header))
    };

    // icmp头
    var icmpHeader = new IcmpV4Header
    {
        Type = IcmpV4MessageType.EchoRequest,
        Code = default,
        Identifier = ipHeader.Id,
        SequenceNumber = ++this.sequenceNumber,
    };

    // 将数据写到packet缓冲区
    var packet = new WinDivertPacket(ipHeader.Length);

    var writer = packet.GetWriter();
    writer.Write(ipHeader);
    writer.Write(icmpHeader);

    return packet;
}

```

--------------------------------

### Capture and Modify Network Packets

Source: https://github.com/xljiulang/windivertdotnet/blob/master/README.md

This C# snippet demonstrates how to capture, process, and modify network packets using WinDivert. It filters packets targeting TCP port 443 with an ACK flag set, then modifies the destination port and recalculates checksums before sending.

```csharp
var filter = Filter.True
    .And(f => f.Network.Loopback)
    .And(f => f.Tcp.DstPort == 443)
    .And(f => f.Tcp.Ack == true);

using var divert = new WinDivert(filter, WinDivertLayer.Network);
using var packet = new WinDivertPacket();
using var addr = new WinDivertAddress();

while (true)
{
    // 读包
    await divert.RecvAsync(packet, addr);

    ProcessPacket(packet, addr); 

    // 修改后发出
    await divert.SendAsync(packet, addr);
}

static unsafe void ProcessPacket(WinDivertPacket packet, WinDivertAddress addr)
{
    // 解包
    var result = packet.GetParseResult();

    // 改包
    result.TcpHeader->DstPort = 443;

    // 重算checksums
    packet.CalcChecksums(addr);
}

```

--------------------------------

### Manipulate Network Packets with WinDivertPacket Class

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

The WinDivertPacket class represents network packet buffers, offering parsing, modification, and cloning capabilities. Access protocol headers and payload data via GetParseResult().

```csharp
using WindivertDotnet;
using System.Net;

// 创建数据包缓冲区，默认容量为 MTU_MAX (65575 字节)
using var packet = new WinDivertPacket();
using var addr = new WinDivertAddress();

// 或指定容量
using var smallPacket = new WinDivertPacket(capacity: 1500);

// 接收数据包后解析
var filter = Filter.True.And(f => f.IsTcp);
using var divert = new WinDivert(filter, WinDivertLayer.Network);

await divert.RecvAsync(packet, addr);

// 解析数据包 - 获取各协议头指针
unsafe
{
    var result = packet.GetParseResult();

    // 访问 IPv4 头
    if (result.IPV4Header != null)
    {
        Console.WriteLine($"源IP: {result.IPV4Header->SrcAddr}");
        Console.WriteLine($"目的IP: {result.IPV4Header->DstAddr}");
        Console.WriteLine($"TTL: {result.IPV4Header->TTL}");
        Console.WriteLine($"协议: {result.Protocol}");
    }

    // 访问 TCP 头
    if (result.TcpHeader != null)
    {
        Console.WriteLine($"源端口: {result.TcpHeader->SrcPort}");
        Console.WriteLine($"目的端口: {result.TcpHeader->DstPort}");
        Console.WriteLine($"序列号: {result.TcpHeader->SeqNum}");
        Console.WriteLine($"SYN: {result.TcpHeader->Syn}, ACK: {result.TcpHeader->Ack}");
    }

    // 访问负载数据
    if (result.DataLength > 0)
    {
        var payload = result.DataSpan;
        Console.WriteLine($"负载长度: {result.DataLength} 字节");
    }
}

// 克隆数据包
using var clonedPacket = packet.Clone();

// 获取数据包的 Span 视图
Span<byte> data = packet.Span;
```

--------------------------------

### WinDivertRouter for Route Calculation

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

The WinDivertRouter class calculates routing information to determine local communication addresses and network interface indexes, useful for setting correct address information when constructing injected packets. It can create a WinDivertAddress or apply routing info to an existing one.

```csharp
using WindivertDotnet;
using System.Net;

// 根据目标地址计算路由
var dstAddr = IPAddress.Parse("8.8.8.8");
var router = new WinDivertRouter(dstAddr);

Console.WriteLine($"目标地址: {router.DstAddress}");
Console.WriteLine($"本机源地址: {router.SrcAddress}");
Console.WriteLine($"网络接口索引: {router.InterfaceIndex}");
Console.WriteLine($"是否出站: {router.IsOutbound}");
Console.WriteLine($"是否回环: {router.IsLoopback}");

// 使用路由信息创建 WinDivertAddress
using var addr = router.CreateAddress();

// 或应用到现有的 WinDivertAddress
using var existingAddr = new WinDivertAddress();
router.ApplyToAddress(existingAddr);

// 获取指定目标地址的网络接口索引
int ifIdx = WinDivertRouter.GetInterfaceIndex(IPAddress.Parse("192.168.1.1"));
```

--------------------------------

### WinDivertAddress Metadata

Source: https://context7.com/xljiulang/windivertdotnet/llms.txt

WinDivertAddress holds packet metadata like timestamp, layer, direction flags, and network interface information. It provides properties to access this metadata and supports cloning and clearing its data.

```csharp
using WindivertDotnet;

using var addr = new WinDivertAddress();

// 基本属性
Console.WriteLine($"时间戳: {addr.Timestamp}");
Console.WriteLine($"工作层: {addr.Layer}");
Console.WriteLine($"事件类型: {addr.Event}");

// 标志位
var flags = addr.Flags;
bool isOutbound = flags.HasFlag(WinDivertAddressFlag.Outbound);
bool isLoopback = flags.HasFlag(WinDivertAddressFlag.Loopback);
bool isSniffed = flags.HasFlag(WinDivertAddressFlag.Sniff);

// Network 层特有的数据
unsafe
{
    var network = addr.Network;
    Console.WriteLine($"网络接口索引: {network->IfIdx}");
    Console.WriteLine($"子接口索引: {network->SubIfIdx}");
}

// 克隆地址信息
using var clonedAddr = addr.Clone();

// 清除数据
addr.Clear();
```
Tokens:
Raw