NDIS or TDI to forward packets to a local proxy
I need to develop a transparent filter to redirect outgoing HTTP packets to a local proxy to do transparent content filtering.
What's the best technology for this, TDI or NDIS IM?
My main limitation is to avoid conflicts with antivirus software, which also does some packet forwarding to inspect HTTP content (I don't know if the antivirus programs use TDI, NDIS IM, or both).
Instead of writing the driver itself, in fact, I am also considering two commercial SDKs for filtering / modifying packets: one uses the TDI driver and the other uses the NDIS IM driver, so the origin of my question (I was only NDIS IM knowledgeable before than looking at two SDKs).
a source to share
NDIS IM gives you access to packages.
If you are redirecting to a proxy you are probably doing it at the connection (TCP) level, in which case it will be a lot of work at the NDIS IM level as you would need to implement the full TCP stack to handle retry, sequencing, etc. .d.
So I would look more at TDI or WFP (depending on the target OS).
Most AVs I know use an LSP for this as well, which is a winsock filter layer. So TDI will be well below that, and will also hijack applications that don't use Windows Sockets for TCP / IP (like Explorer, SMB clients, etc.).
a source to share