Section 3: Winsock

The Big Picture: The Door Programs Use

Programs do not build TCP segments or talk to NICs. They ask Windows to do it, through a standard set of functions. That set is called Winsock (Windows Sockets). It is the "front door" of the networking stack from Section 2.

3.1 Socket API for Windows Applications

What it is: A socket is a handle (a number the program holds) that stands for one end of a network conversation. Think of it as a telephone: you pick one up, dial, talk, and hang up. Winsock is the library (ws2_32.dll) that gives programs those telephones. It follows the older "Berkeley sockets" idea from Unix, plus some Windows additions.

The main calls:

(UDP programs use sendto and recvfrom, because UDP has no connection and each message carries its own destination.)

A simple TCP client and server, side by side:

   SERVER                                   CLIENT
   ──────                                   ──────
   WSAStartup                               WSAStartup
   socket()                                 socket()
   bind(port 8080)
   listen()
   accept()  ── waits ─────────┐
                               │            connect(server IP, 8080)
                               └────────◄── TCP three-way handshake
   accept() returns a new socket
   recv()  ◄──────────────────────────────  send("hello")
   send("hi") ───────────────────────────►  recv()
   closesocket()                            closesocket()
   WSACleanup                               WSACleanup

The three-way handshake in the middle is done by tcpip.sys, not by the program. The program just calls connect and the stack does the SYN, SYN-ACK, ACK exchange you learned in the previous chapter.

Blocking and non-blocking. By default, many calls are blocking: recv simply waits until data arrives, and the program does nothing else meanwhile. That is easy to write but a window can freeze if it does this on its main thread. A socket can instead be set to non-blocking mode, where a call returns at once with "would block, try later". Programs that handle thousands of connections use even more advanced Windows methods such as overlapped I/O and I/O completion ports (IOCP), which let Windows tell the program when work is done. You only need to know the names for now.

What happens under the call: send() in ws2_32.dll goes to AFD (afd.sys) in the kernel. AFD keeps the socket's buffers and hands the data to tcpip.sys (Section 2). So a socket is really an object in kernel memory, and your program holds a handle to it.

Seeing sockets: netstat -ano lists them. LISTENING means a server did listen. ESTABLISHED means a connection is open. The last column is the PID of the owner.

Windows tip: If a program says "address already in use", another program already did bind on that port. Run netstat -ano, find the port, and match the PID in Task Manager.

3.2 Winsock Service Providers (LSPs)

What it is: Winsock is not one fixed block of code. It keeps a catalog: a list of providers that handle the different protocols (TCP/IP, UDP, and so on). Windows itself supplies the standard ones.

An LSP (Layered Service Provider) is an extra provider that older software could insert above the standard one. Every call then passed through the LSP first. Antivirus, parental-control and some proxy programs used this to watch or change network traffic.

 Application
     │
 ┌───┴─────────────────┐
 │ LSP (third-party)   │  ◄── could read or alter every call
 ├─────────────────────┤
 │ Standard provider   │
 └─────────────────────┘

Why LSPs fell out of favour:

• A buggy LSP could break all networking for every program.
• Removing one badly could leave the Winsock catalog damaged.
• They sat in the way of every program and slowed things down.

Microsoft deprecated (discouraged) LSPs in newer Windows versions. Modern security and VPN software uses the Windows Filtering Platform (Section 2.3 and Section 7) instead. You may still meet an old LSP on an old PC, or in malware.

Hedge: LSP support still exists in Windows for compatibility, but its use is discouraged, and some modern app types ignore it.

Repairing the catalog: When the catalog is damaged, symptoms include "no internet" in some programs while ping works. An administrator can reset it with netsh winsock reset. This changes the system and needs a restart, so treat it as a repair step, not something to try for fun. This course's lab does not use it.

Summary