First, thank you all for getting me started in the right
direction. The links for info have been excellent.
As I have begun to learn the technology and vocabulary I
can now communicate somewhat better.
I have pushed back to management that we do not need to
develope a true vNic.
The requirements are thus:
Watch all network packets and redirect some of them to a
different address. The the redirected packet will become a
piece of data in a new stream of data sent by a socket to
the different address. The "packet watcher" doesn't need
to send the packet to a new address,it can call to "up" to
an appliation layer to send it.
Forgive me if this is not making sense, I am still getting
the terms down.
So, I think it can be done with:
NDIS Intermediate Driver
OR
Filter Hook Driver
Filter Hook Drivers seem to have the contsraint of only
one hook. Some kind of entry point table for the hook and
whover installs the address of their entry point gets the
call.
From my description, which do you think is the approach I
should continue to research? Maybe there is an approach I
have missed?
Thank you for your help.
Gil