Three Windows networking SDKs I maintain expose different layers of the same machine. Choosing one starts with the question you want to answer: which connection event occurred, which Ethernet frame was observed, or which local rule matched a connection.
The examples below summarize their documented interfaces and limits. Each repository includes its own setup and qualification notes.
Match the question to the layer
| Your integration needs | Project | Observation or control boundary |
|---|---|---|
| Process, endpoint and connection-lifecycle metadata | Connection Trace Studio | Windows Filtering Platform lifecycle stages |
| Bounded IN/OUT Ethernet frame records from one selected adapter | Packet Capture SDK | An NDIS lightweight filter |
| Attributed decisions from local process/port/CIDR rules | Titan Network Filter | WFP authorization and reauthorization |
Connection lifecycle: keep the stage with the event
Connection Trace Studio collects read-only lifecycle metadata through a WFP sensor. A native consumer can correlate process IDs, endpoint identifiers, addresses, ports and observed stages.
Keep the stage label in your data model. A TCP established notification and a non-TCP authorization have different meanings. Reauthorization can occur after the initial decision, and capture can begin after a connection's first event. PID reuse and missing events also affect correlation.
The bounded correlator marks gaps and ambiguous reuse as incomplete. Application paths are opt-in, and endpoint identifiers are pseudonymized per capture. Address and process metadata still deserve careful handling even when packet content is absent.
For a support integration, report the observed stage and its availability flags alongside any conclusion you draw from it.
Ethernet frames: preserve the captured length
Packet Capture SDK selects one attached Ethernet filter module and supplies bounded IN/OUT records. Each record carries direction, original and captured lengths, sequence information, a software QPC timestamp and up to 1,518 frame bytes.
A reader drains at most 16 records per call from a 256-record ring. Old diagnostic records can be overwritten. Include the loss and truncation information in your application instead of presenting a complete-traffic claim.
These frames describe the NDIS boundary, where offloads can affect what is observed. The documented scope excludes Wi-Fi monitor mode, raw 802.11, loopback capture and arbitrary MTUs. Its raw L2 transmission method is a separate explicit operation; accepting a send and completing it are separate events.
That makes adapter identity, capture loss and the definition of a timestamp part of the integration contract.
Local rules: preserve the decision's attribution
Titan Network Filter exposes up to 64 ordered rules with atomic policy replacement. Rules can select process, direction, protocol, ports and a remote IP/CIDR. The event data includes the policy generation and matching rule ID.
Retain those fields when exporting a decision. They make it possible to relate an observation to the policy that produced it, including changes during a session.
A Continue decision leaves other Windows filters in control. Updating a rule also does not promise immediate disconnection of every previously authorized flow; the documented test workflow creates a new connection for a changed rule. IP byte/buffer counters describe their WFP layer and sampling window, rather than application goodput or physical-wire throughput.
The tool starts inactive, and its owned dynamic policy is released on session cleanup. Its documented role is a local integration and diagnostic component; production deployment needs qualification for the intended environment.
Inspect the interface before installing a driver
After extracting the complete release for the product you chose, its matching offline preview command is:
# Connection Trace Studio .\ConnectionTraceStudio.exe --preview # Packet Capture SDK .\PacketCaptureStudio.exe --preview # Titan Network Filter .\TitanNetworkFilter.exe --preview Each command belongs to its own product directory. These labelled previews use synthetic data and do not open the live driver. Live operation has separate installer, elevation and, for Packet Capture SDK, product-specific access-key requirements.
Application/SDK source and driver terms are separate. Read the selected release's README and binary licence, then define acceptance criteria around the boundary your application actually needs. The published validation notes describe the Windows configurations exercised; they do not establish universal adapter or application compatibility.
More tools are grouped in the project directory, with exact SDK package names and installation guides in the package catalogue.
Disclosure: generated by an AI assistant on behalf of the project maintainer from the linked project documentation. No new live-network qualification is claimed in this article.
