Section 2: Windows Networking Stack

The Big Picture: Layers from Top to Bottom

Windows does not handle networking in one lump. It uses layers, like floors of a building. Each layer does one job and only talks to the floor directly above and below. A stack is simply this pile of layers.

The previous chapter showed the idea of layers (application, transport, internet, link). This section shows the real Windows files that fill those layers.

2.1 Layered Architecture (Application → Winsock → AFD → TCP/IP → NDIS → Miniport → NIC)

 USER MODE (normal programs, limited power)
 ┌─────────────────────────────────────────────┐
 │ Application (browser, game, Outlook ...)    │
 ├─────────────────────────────────────────────┤
 │ Winsock API            (ws2_32.dll)         │
 └─────────────────────┬───────────────────────┘
 ══════════════════════╪═══ system call: user mode -> kernel mode
 KERNEL MODE (the OS core, full power)
 ┌─────────────────────┴───────────────────────┐
 │ Winsock kernel driver  (afd.sys)            │
 ├─────────────────────────────────────────────┤
 │ TCP/IP protocol driver (tcpip.sys)          │
 ├─────────────────────────────────────────────┤
 │ NDIS                   (ndis.sys)           │
 ├─────────────────────────────────────────────┤
 │ Miniport driver (Intel, Realtek, Wi-Fi ...) │
 └─────────────────────┬───────────────────────┘
                       │
                 ┌─────┴─────┐
                 │ NIC (hw)  │
                 └───────────┘

What each layer does:

User mode and kernel mode. Windows has two "worlds". In user mode, normal programs run with limited power, so a crash cannot take down the whole PC. In kernel mode, the operating system core and drivers run with full power over the hardware. A program crosses the line with a system call (a controlled request to the kernel). In the diagram, the double line is that border. Everything from AFD downward is kernel code. (See Chapter 12 for more on these two worlds.)

Notice: A packet never goes "straight from the app to the wire". It passes through several layers one after another, and the same layers work in reverse for incoming data.

2.2 How Data Moves Down and Up

Suppose a program sends a short message to a server. This is the simplified trip:

1. The app calls send() in Winsock (ws2_32.dll).
2. Winsock passes the request to AFD in the kernel.
3. AFD hands the data to tcpip.sys. TCP cuts it into segments and adds a TCP header (port numbers, sequence numbers). Then IP adds its header (source and destination IP address). This is the encapsulation from the previous chapter.
4. tcpip.sys finds the next hop (Section 9: the routing table) and its MAC address (Section 4: the neighbor cache).
5. The finished packet goes to NDIS, which gives it to the miniport driver.
6. The miniport places the frame (the packet plus an Ethernet or Wi-Fi header) in a buffer and tells the NIC to send it by DMA.

Receiving is the same trip upward: NIC, interrupt, miniport, NDIS, tcpip.sys (checks headers, rebuilds the data stream), AFD, Winsock, and finally the application.

2.3 Where the Firewall Hooks In: WFP

What it is: The Windows Filtering Platform (WFP) is a set of hooks (called layers) built into the networking stack. At each hook, a filter can look at a packet or a connection and decide: allow, block, or hand it to another component.

Think of WFP as security checkpoints at several doors inside the building, not one guard at the front gate.

        Application
            │
   ┌────────┴────────┐
   │  Winsock / AFD  │  ◄── WFP hooks: "may this program connect or listen?"
   ├─────────────────┤
   │    tcpip.sys    │  ◄── WFP hooks: transport and network layers
   ├─────────────────┤       (inspect and filter packets)
   │      NDIS       │
   ├─────────────────┤
   │    Miniport     │
   └─────────────────┘

The Windows Firewall (Section 7) is built on WFP. Other security products and VPN software can add their own WFP filters too. The exact layers and their names are a deep topic. For this course, remember the idea: filtering happens inside the kernel, in the path of every packet.

2.4 Seeing the Stack in Action

Windows tip: In Task Manager → Details, right-click the column header, choose Select columns and add PID. Then match a PID from netstat -ano to see which program owns a connection.

Hedge: Newer Windows versions rearrange some internal details, and some protocols (for example QUIC, which browsers run over UDP) are partly handled by other components. The big picture above stays the same.

Summary