subject: When To Use Winsock Lsp? [print this page] Winsock LSP is a code that sits between the Winsock in Windows based systems and the applications using the network. Given its unique position this piece of code is excellent for inspecting traffic and acting on them accordingly. This is a great tool for corporate or even domestic security and supervision.
Of course when it comes to such inspection and act services, LSP is not the only solution in the market. There are other equally good alternatives and choosing one of them depends on what the requirements are. The two popular alternatives are TDI and NDIS. TDI or Transport Device Interface is a code that works at the kernel level. It has many good features that make bit stream inspection solutions simple to implement with this option.
The Network Driver Interface Specification or NDIS is a set of APIs that allow upper layers to talk with the network drivers and interfaces that actually transmit the traffic on the network. Logically, the NDIS is akin to the LLC layer in OSI model. NDIS specs are available for multiple operating systems and hence it is more of a universal standard.
Now coming back to the question on when is it best to use Winsock LSP. Looking at how these technologies operate, it is clear that NDIS and LSP are more kernel level solutions that interface with the hardware. As a result they can examine the bit streams better. They can also work at higher layers, but that would mean that the solution would have to rebuild the packets before examining them.
The LSP approach is a natural solution to the packet examination as it can read all the packets moving across the system. Scanning packets and taking actions is better implemented with this solution. So solutions that depend on TCP or IP level information for filtering or redirection are better addressed with Winsock LSP.
On the other hand, if the examination needs to be done at frame level rather than packets, then LSP approach is not a good option. In fact, it may not be able to provide any solution given its limitation on the protocol stack.
