2
My question is about networking software and where it inputs and outputs. I kind of understand the OSI model, but what I don’t really understand is where virtual network adapters and software like WinPcap and firewalls fall into it.
What I'm thinking is (and I'm usually wrong so please correct me):
WinPcap is software to read (not delete or modify normal network traffic) and do its own thing with that data at the data link layer? For example, a web request is sent from your router to your PC the data travels like this:
- (physical) traffic from router is sent through Ethernet cable
- (physical) Ethernet interface network adapter and driver
- (data link) mac sees what devices it is
- (data link) llc flow control data checks
- (data link) WinPcap reads data here?
- (network) IP is read here
- (transport) TCP/UDP is handled here
- (session) application connection and ports here
- (syntax) ASCII encoding/decoding
- (application) http
The case with virtual adapters is they are tricking the system in running the data through two physical adapters however one isn't actually physical, it's software to encrypt data (possibly something else). So for example:
- (physical) traffic from router
- (physical) Ethernet interface network adapter
- (physical) virtual network adapter
- (data link) mac
- (data link) llc
- (network) IP
- (transport) TCP
- (session) application connection and ports
- (syntax) ASCII encoding/decoding
- (application) http
With a well designed firewall it intervenes in multiple places like:
4. mac
6. IP
7. TCP
8. application and ports
10. http
Generally asking for reading material would be off-topic. It's not entirely clear what your real question is. A piece of software can handle multiple layers at once or they might as well not be existent - Think about TCP/UDP and sessions.
– Seth – 2016-12-08T07:23:01.167