截包的需求一般来自于过滤、转换协议、截取报文分析等。 过滤型的应用比较多，典型为包过滤型防火墙。 转换协议的应用局限于一些特定环境。比如第三方开发网络协议软件，不能够与原有操作系统软件融合，只好采取“嵌入协议栈的块”（BITS）方式实施。比如IPSEC在Windows上的第三方实现，无法和操作系统厂商提供的IP软件融合，只好实现在IP层与链路层之间，作为协议栈的一层来实现。第三方PPPOE软件也是通过这种方式实现。 截取包用于分析的目的，用“抓包”描述更恰当一些，“截包”一般表示有截断的能力，“抓包”只需要能够获取即可。实现上一般作为协议层实现。 本文所说的“应用层截包”特指在驱动程序中截包，然后送到应用层处理的工作模式-cut the demand for general packet from the filter, change the agreement, reported the interception of text analysis. Filter - type applications are more typical for packet filtering firewall. The conversion agreement was limited to a specific application environment. For example, third-party development of network protocol software, not the original operating system software integration, they take "embedded protocol stack block" (BITS) implementation. For instance, IPSEC on Windows third-party realized, unable and operating system vendors to provide IP software integration, but to achieve the IP layer and link layer between as the layer protocol stack to achieve. PPPOE third-party software is achieving in this way. Packet interception for the purpose of analysis, "capturing