For these reasons, WinPcap outperforms other comparable approaches. WinPcap implements all of the classic optimizations described in the packet capture literature (e.g., kernel-level filtering and buffering, context switch mitigation, partial packet copy), plus some original ones, like JIT filter compilation and kernel-level statistic processing. WinDump can be used to watch, diagnose and save to disk network traffic according to various complex rules. is also the home of WinDump, the Windows version of the popular tcpdump tool. Some of these tools, like Wireshark, Nmap, Snort, ntop are known and used throughout the networking community.

Thanks to its set of features, WinPcap is the packet capture and filtering engine of many open source and commercial network tools, including protocol analyzers, network monitors, network intrusion detection systems, sniffers, traffic generators and network testers. This library also contains the Windows version of the well known libpcap Unix API. WinPcap consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. WinPcap is the industry-standard tool for link-layer network access in Windows environments: it allows applications to capture and transmit network packets bypassing the protocol stack, and has additional useful features, including kernel-level packet filtering, a network statistics engine and support for remote packet capture. WinPcap for Windows 10 - Full description

Winpcap wireshark portable