Winsock, AFD, and kernel boundaries
How user-mode sockets relate to kernel-mode transport, and why AFD.sys matters.
Related labs
Hands-on exercises for this area — in the browser or on a Windows machine.
View all labsGuided paths in this branch
Follow a short sequence step by step. Each path links to the first topic; use Read next on each page to continue.
Networking stack tour
Follow a connection from Winsock and DNS through TCP/IP, filtering (WFP/BFE), down to NDIS and the NIC.
Step 3 of 7 in this path
Official Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
This is the bridge between app-level sockets and the kernel networking stack. It helps learners understand where overhead and security boundaries sit.
Mental model
Apps speak Winsock in user mode. Kernel components speak a kernel socket interface, and system drivers like AFD.sys sit in the middle to provide efficient transport access.
How it works
- 1Applications create sockets via Winsock, which routes requests to the kernel networking stack.
- 2Kernel-mode components can use Winsock Kernel (WSK) interfaces for network I/O without user/kernel switching overhead.
- 3System drivers (including AFD.sys) participate in socket plumbing and transport exposure to higher layers.
Key terms
- Winsock
- The primary Windows sockets API used by applications.
- WSK
- Winsock Kernel, a kernel-mode socket interface for system components.
- AFD
- Ancillary Function Driver for Winsock, a kernel-mode driver involved in sockets.
High-throughput networking
Scalable servers depend on understanding where buffering happens and where boundaries introduce overhead in the networking path.
Common misconception
People treat 'TCP/IP stack' as one box. In practice, there are layers and interfaces that separate app APIs, system drivers, and transport implementation.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
intermediate
TCP/IP stack
The core protocol machinery behind Windows network communication.
Next step in your guided path
expert
WFP & BFE (deep dive)
How filters are stored, enforced, and hooked into the packet path.
Natural next depth in this branch
beginner
I/O system
How Windows turns API requests into IRPs, driver stack work, and device operations.
Related topic