Winpcap is generally used to 'listen' to the network. Generally if you're the producer or consumer of particular traffic in the network then you'd use sockets. It would be rare to use winpcap for this, because with winpcap I imagine you're manually assembling a TCP/IP frame. Sockets provides you with a set of functions and a framework for being able to set up comms sessions and receive data into your application based on port numbers, i.e. it understands UDP and TCP layers. (Sockets also keep a memory of the current session states, i.e. it knows the handshake procedures for TCP, because it has a state machine). When you're using a network, you don't want to manually assemble the Ethernet, IP, TCP headers (and checksums...) each time you send a packet or receive a response, and you don't want to manually try to figure out if you've done the correct handshake or if there was a delay, error and so on. The socket functions will just tell you that. Besides, sockets are available on all (most) OSs, unlike winpcap.