This paper introduces two approaches to develop the network protocol analyzers, one of which is based on NDIS (Network Driver Interface Specification), the other is based on WinPcap. The second approach is discussed in details. This paper outlines the WinPcap architecture. Functions exported by WinPcap are classified in three types. On this classification, we can accurately configure the developing environment, e.g. define the preprocessors, set working directories. Three basic functions, i.e. pcap_ findalldevs_ex(), pcap_open(), and pcap_next_ex(), are interpreted thoroughly. In the end, a step-by-step example is given with its outcomes.