Windows Networking Internals


Duration 3 days lecture + hands-on lab
Audience Course is targeted to device driver developers, application programmers, development managers, program managers, software QA engineers and technical support engineers. Please note this not a network administration course.
Pre-requisites Basic understanding of network protocols (TCP/UDP/IP/ICMP/ARP/DHCP/DNS). Familiarity with the Windows NT/2000/XP/2003 operating system is required. Familiarity with ‘C programming language, knowledge of device drivers and Win32 API is preferred
Description The course covers the architecture and internals of the Windows networking stack end-to-end flow of socket operations, kernel mode interfaces for networking drivers, Windows network file systems and RPC communications.
Through the hands-on labs, attendees re-enforce the theory by actually debugging network drivers and other network components inside a Virtual Machine.
Upon completion of this intermediate level course, attendees will develop a good understanding of the “behind the scenes” workings of the Windows networking stack, be able to debug various network related problems both at the programming level and at the network packet level.

Networking Stack
  • WinSock Interface
  • Winsock Service Providers (LSP)
  • Winsock Helper DLLs
  • DNS
  • Kernel Mode Components & APIs
  • RDBSS and Mini Redirectors
  • RAS
NDIS
  • NDIS Drivers
  • Miniport Drivers
  • Protocol Drivers
  • OIDs
  • Packets & Buffers
  • Data Transfers
  • Internal Data Structures
  • Intermediate Drivers
  • Notify Objects
TDI
  • TDI Drivers
  • Address and Connection Objects
  • Requests & Events
  • Clients & Servers
  • Data Transfers
  • TCPIP.sys TDI Interface
SMB
  • Architecture
  • Transports
  • Protocol
  • Connections
  • Data Transfers
  • Named Pipes
  • Mailslots
RPC
  • Architecture
  • Protocol Sequences
  • Endpoints and Interfaces
  • Internal Data Structures
  • RPC Network Traffic
  • Local RPC