Contrast with traditional packet filter techniques which based on NDIS (Network Driver Interface Specification), it can capture data of any process in application layer. However, the hook techniques are pretty complicated.

• ，s进程套接字数据劫持技术研究有相当难度，与传统的基于网络设备接口规范(NDIS)的包过滤技术相比，该技术的不同之处在于它可以在应用层上对任意进程的网络输入和输出数据进行捕获。