diff --git a/README.md b/README.md
index 5ef624f..86c2878 100644
--- a/README.md
+++ b/README.md
@@ -29,12 +29,19 @@ libpcap is missing, `install.sh` will skip those two and build the rest.
 
 ### Platform Support
 
-Linux and macOS only. Native Windows builds (MSYS2/MINGW64, plain `go build`
-on Windows) are **not supported** - `pkg/transport` uses libc's `connect()`
-via cgo so that `LD_PRELOAD`-based proxies like proxychains can hook it,
-which has no Windows equivalent. On Windows, use
-[WSL](https://learn.microsoft.com/windows/wsl/install) and build from inside
-the Linux environment.
+gopacket builds on Linux, macOS, and Windows. The set of working tools and
+available proxying paths depends on the build flags:
+
+| Build                                  | Tools available                        | Proxying                                            |
+|----------------------------------------|----------------------------------------|-----------------------------------------------------|
+| Linux / macOS with cgo (default)       | All 63                                 | proxychains (LD_PRELOAD) and/or `-proxy` SOCKS5     |
+| Linux with `CGO_ENABLED=0`             | 61 (`sniff`, `split` become stubs)     | `-proxy` only (proxychains needs the libc hook)     |
+| Windows (`GOOS=windows CGO_ENABLED=0`) | 60 (`sniff`, `split`, `sniffer` stubs) | `-proxy` only (no `LD_PRELOAD` on Windows)          |
+
+`sniff` and `split` depend on libpcap via cgo; `sniffer` depends on Unix raw
+sockets. When a tool can't be built for the target, gopacket substitutes a
+stub that prints a clear message and exits 1, so `go build ./...` always
+succeeds and the install layout is consistent across platforms.
 
 To uninstall:
 ```bash
@@ -63,7 +70,7 @@ gopacket-secretsdump -proxy socks5h://127.0.0.1:1080 'domain/user:password@targe
 ALL_PROXY=socks5h://127.0.0.1:1080 gopacket-smbclient 'domain/user:password@target'
 ```
 
-UDP-dependent features are **disabled** under `-proxy` rather than silently leaking packets (SOCKS5 UDP ASSOCIATE is rarely supported by proxies, and bypassing the proxy for UDP would reveal the attacker's real source IP). Affected features and their workarounds are documented in [KNOWN_ISSUES.md #9](KNOWN_ISSUES.md).
+UDP-dependent features are **disabled** under `-proxy` rather than silently leaking packets (SOCKS5 UDP ASSOCIATE is rarely supported by proxies, and bypassing the proxy for UDP would reveal the operator's real source IP). Affected features and their workarounds are documented in [KNOWN_ISSUES.md](KNOWN_ISSUES.md).
 
 **Chaining:** `-proxy` is compatible with proxychains. The TCP connection to the SOCKS5 proxy itself still goes through libc `connect()`, so `proxychains → gopacket → -proxy → target` works for nested routing scenarios.