WFP: TCP closesocket for inbound connection. RRS feed

  • Question

  • I want to track LISTEN TCP connection, I am getting callaback when listen() occurs(FWPM_LAYER_ALE_AUTH_LISTEN_V4)
    similarly I want to track when connection gets closed(closesocket())), Is there any LAYER I can register for the same.

    I tried to track at layer FWPM_LAYER_ALE_RESOURCE_RELEASE_V4/V6 but my callabck didnt hit.

    Any help really appriciated.
    Friday, May 10, 2019 8:50 AM