Chapter 28 · Windows Networking Internals

Knowledge Check

8 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What does NDIS stand for, and what is its job?
  2. What is a miniport driver?
  3. Name the layers a packet passes from an application down to the NIC, using file names.
  4. What is the difference between ws2_32.dll and afd.sys?
  5. Which service keeps the DNS cache, and which command empties it?
  6. In what order does Windows look for a name: hosts file, cache, DNS server?
  7. What does an address like 169.254.x.x tell you?
  8. What are the service names of Windows Defender Firewall and the Base Filtering Engine?
  9. Which three network profiles exist, and which one is the most locked down?
  10. What does On-link mean in route print?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. NDIS

Network Driver Interface Specification. It is the standard set of rules (and ndis.sys) between network drivers and the protocols above them, so the upper layers do not have to know each chip.

2. Miniport driver

The small, hardware-specific driver for one kind of NIC. NDIS does the common work; the miniport only talks to the hardware.

3. The layers

Application, Winsock (ws2_32.dll), AFD (afd.sys), TCP/IP (tcpip.sys), NDIS (ndis.sys), the miniport driver, the NIC.

4. ws2_32.dll vs afd.sys

ws2_32.dll is the user-mode library an app calls. afd.sys is the kernel-mode driver behind it that keeps socket state and buffers and talks to tcpip.sys.

5. DNS cache

The DNS Client service (Dnscache). ipconfig /flushdns (or Clear-DnsClientCache) empties it.

6. Lookup order

The hosts file first, then the DNS Client cache, then the configured DNS server (UDP port 53).

7. 169.254.x.x

APIPA: DHCP did not answer, so Windows gave itself a local-only address. There is no gateway and no internet.

8. Service names

MpsSvc (mpssvc) for Windows Defender Firewall, and BFE for the Base Filtering Engine.

9. Profiles

Domain, Private, Public. Public is the most locked down.

The destination is on your own network, so the packet is sent directly (using ARP), with no router needed.

UNDERSTANDING QUESTIONS

Q1. Why does Windows use NDIS instead of letting TCP/IP talk to each NIC directly?

Answer Hundreds of NIC models exist, each controlled differently. NDIS gives the upper layers one standard way to send and receive packets, so tcpip.sys needs no knowledge of any chip. It also lets virtual adapters (Hyper-V, VPN) look like real ones.

Q2. Why is the Windows Firewall described as "rules loaded into WFP" and not a separate wall?

Answer MpsSvc reads your rules and turns them into filters that BFE passes to the Windows Filtering Platform. WFP has hooks at several layers inside the networking stack in the kernel and enforces the filters on every packet and connection. There is no outside barrier, just checks inside the path.

Q3. Why does the hosts file need administrator rights to edit, and why is that important?

Answer Because it overrides DNS. Whatever is written there wins before any real DNS answer. If any program could edit it, malware could silently send your bank's name to a fake server. Requiring admin rights makes that harder (though malware that gains admin rights can still change it).

Q4. Why does a faraway packet have the server's IP address but the gateway's MAC address?

Answer The IP address is the final target. The MAC address only works on the local network, so it names the next hop, the gateway. Each router on the way builds a new frame with a new MAC for its next hop, while the IP stays the same.

Q5. Why does the DHCP client try to renew at about half of the lease time?

Answer Renewing early means the PC keeps its address without a gap. If the first try fails, there is still plenty of time left to try again, and only at the very end does it start the full discovery process over.

SCENARIO QUESTIONS (Troubleshooting)

S1. ipconfig shows 169.254.37.12 and there is no internet. Where do you look first?

Answer DHCP failed. Check the cable or Wi-Fi connection, whether the router is on and its DHCP server is enabled, and `Get-Service Dhcp`. DNS and internet settings are not the problem yet. After fixing the cause, the address renews (a restart of the adapter or `ipconfig /renew` can help; note it briefly disconnects).

S2. A website opens on your phone but goes to the wrong page on your PC only. What might be wrong?

Answer Likely a hosts file entry (possibly added by malware) or a stale DNS cache. Read the hosts file, flush the cache with `ipconfig /flushdns`, and compare with `nslookup` and `Resolve-DnsName`. Run a security scan if you find entries you did not make.

S3. A game server works at home but not at a cafe, using the same PC. Why?

Answer The network profile changed from Private to Public. Firewall rules and discovery settings for the Public profile are stricter, and the app may be allowed only on Private. Check with `Get-NetConnectionProfile` and the firewall rules.

S4. ping 8.8.8.8 works, but web pages do not open and ping google.com fails. What does that suggest?

Answer Basic connectivity (IP, gateway, routing) works. Name resolution is failing. Check DNS Servers in `ipconfig /all`, `Get-Service Dnscache`, try `nslookup google.com`, and flush the cache.

S5. A VPN is on and some websites suddenly use the wrong connection. Where would you look in the routing table?

Answer `route print` or `Get-NetRoute`: look for new routes added by the VPN, especially a second default route and the metrics. The route with the lowest metric (or the most specific match) wins, so the VPN may be taking traffic that would normally go out the normal gateway.

INTERVIEW QUESTIONS

I1. Walk me through what happens between pressing Enter on google.com and seeing the page, from the PC's point of view.

Answer Browser cache, then Windows (hosts file and DNS Client cache), then a DNS query over UDP 53. The routing table picks the default gateway and ARP finds its MAC. A TCP three-way handshake (via Winsock, AFD, tcpip.sys) connects to port 443, TLS sets up encryption, the HTTP request is sent and the response comes back. Throughout, frames pass through NDIS and the miniport to the NIC using DMA and interrupts. Finally, the browser renders the page.

I2. Explain the difference between nslookup and Resolve-DnsName or the browser's lookup.

Answer `nslookup` sends its own queries directly to a DNS server and skips the Windows cache and hosts file. `Resolve-DnsName` and programs using the normal Windows resolver use the full order: hosts, cache, then DNS servers. They can differ when the hosts file or cache has something different.

I3. What is the role of AFD in the Windows network stack?

Answer The Ancillary Function Driver is the kernel half of Winsock. It owns each socket's kernel state and buffers, handles blocking and overlapped operations, and connects the user-mode Winsock call to tcpip.sys.

I4. How does Windows choose between two routes to the same destination?

Answer It picks the most specific match first (longest prefix). If matches are equally specific, the lowest metric wins. Metrics usually come from interface speed unless set manually.

I5. What is a Layered Service Provider and why is it discouraged now?

Answer An LSP is a third-party component inserted into the Winsock catalog to see or change calls. A faulty LSP could break all networking, and it was slow and fragile. Modern software uses the Windows Filtering Platform instead.

PRACTICAL TASK

Draw a one-page "life of a web request" for your own PC. Use the numbers from your Practical Lab. Draw boxes for: your browser, the DNS Client (with a note of one cached name), your DNS server address, the routing table's default route, your gateway (with its IP and MAC), a remote server, and your NIC (with its driver version). Connect them with arrows and number the steps from 1 to 8.

Why This Matters

When "the internet is broken", you can walk down your drawing and test one step at a time: adapter (Get-NetAdapter), address (ipconfig /all), gateway (ping), name (nslookup), route (route print), connection (netstat). That turns a vague complaint into a short, ordered check.

CHAPTER SUMMARY

  • A network adapter is controlled by an NDIS miniport driver. NDIS gives the upper layers one standard interface; virtual adapters (Hyper-V, VPN, loopback) use it too.
  • The Windows stack goes application, Winsock (ws2_32.dll), AFD (afd.sys), TCP/IP (tcpip.sys), NDIS (ndis.sys), miniport, NIC, with WFP hooks for filtering.
  • Winsock gives programs sockets: socket, bind, listen, accept, connect, send, recv. LSPs are an old, discouraged way to add layers.
  • tcpip.sys runs IPv4 and IPv6, TCP, UDP and ICMP, with auto-tuning, congestion control and offloads. It keeps the neighbor cache and routing table.
  • The DNS Client (Dnscache) caches answers; the order is hosts file, cache, DNS server.
  • The DHCP Client (Dhcp) leases settings; APIPA (169.254.x.x) is the fallback when DHCP fails.
  • Windows Defender Firewall (MpsSvc) and BFE load rules into WFP. Block beats Allow; inbound is blocked and outbound allowed by default.
  • Network profiles (Public, Private, Domain), decided by NlaSvc, change how open the PC is.
  • The hosts file overrides DNS and needs admin rights; the routing table picks the exit by most specific match, then metric.
  • Typing a web address uses all of these in one chain, with the NIC, DMA and interrupts at the bottom.