基于NDIS的网络监视实现技术剖析

从构造一个高性能网络监视系统的角度，介绍了NDIS（Network Device Interface Specification)及其在Windows网络协议栈实现中的地位和作用，剖析了采用核心态NDIS协议驱动程序实现与底层网络接口设备具体细节无关的网络监视技术，给出了在内核和核外使用这项技术的基本方法；建立了基于NDIS的网络监视系统的基本构造模型和性能分析模型，给出了系统典型的构造过程和操作过程，展示了系统所具备的良好的结构性、扩展性、并行性、效率性和可编程性，评估了其性能参数，给出了实验方法和实验数据。

Analysis of the Implementation of NDIS Based Network Monitoring

To implement a network monitoring system of high performance, NDIS(Network Device Interface Specification) and its contributions to the implementation of network protocol stacks in Windows systems were introduced. The technology of using a kernel NDIS protocol driver to implement network monitoring not depending on the details of underlying hardware was analyzed and the basic means of using it inside and outside the kernel were given. A basic composition model and a performance evaluation model of NDIS based network monitoring system were constructed. The system's typical develoment process and main operation steps were given and its modularity, concurrency, efficiency, and programmability were indicated. Finally, its performance was evaluated and both the experimental methods and the data were given.