Retail Products

First LSP tip

LSPs aren’t made equal, they come in two flavors, Non IFS LSP (which is covered in the guide) and IFS LSP, what’s the difference? IFS LSP is using IFS handles which are the same handles the Kernel uses, which means that you can only implement a subset of methods, when writing NonIFSLSP you must implement all of Winsock LSP methods, and also create wrappers for two different non blocking I/O methods because NonIFSLSP translates the Kernel IFS handles to a local handle and must convert it back before calling the needed Kernel function. All the functions and wrappers are implemented with the default sample, but it means you need to learn more in order to control your LSP properly, but when writing an IFS LSP, you can implement just the methods you want to modify:

• Do you want to only Redirect a connection? then you can overide WSPConnect
• Do you want to inspect incoming data? then you can overide WSPRecv

However IFS LSP does have drawbacks, it can’t intercept overlapped operations and operations that are done by using non Winsock API such as WriteFile and ReadFile. In Komodia’s products we are using NonIFSLSP and the reason is that because our products cover 95% of all network interception needs, we can’t have exceptions and we need to intercept everything.

You can read more about the difference between IFS and non IFS LSPs here