Avoiding cloning and reinjecting RRS feed

  • Question

  • Hi,

    I have a simple and basic question.

    I need to change only a very little stuff in the incoming packet. Can i do this in the classify function itself and set the status to 'ACCEPT' instead of using a DPC or worker thread. I am trying to avoid cloning and re-injecting logic.

    Please Help.


    Friday, April 30, 2010 7:27 AM


  • This is not a supported approach, and has multiple caveats, one of which is if this is TCP at any of the transport layers (TRANSPORT, STREAM_PACKET, RECV_ACCEPT,...) then you will hit the stack's internal TCP processing locking mechanisms and potentially deadlock.

    If you are sitting at the network layers (IPPACKET) or are acting on non TCP (RAW, UDP, ICMP, etc) at the transport layers , then you can do your injection inline (no worker thread needed).  The classify will still return BLOCK, but the clone and inject are called from within the classify itself.

    Hope this helps,

    Dusty Harper [MSFT]
    Microsoft Corporation
    This posting is provided "AS IS", with NO warranties and confers NO rights
    Friday, April 30, 2010 4:55 PM