Explicit congestion notification events using WFP RRS feed

  • Question

  • Hello, I interested in finding simple way to detect ecn events for particular interface using WFP. Briefly saying I need to filter TCP/IP stack looking for packets with ECN-echo or ECT/CE.

    Thursday, September 8, 2011 9:34 AM


  • This will require using a callout driver.  You would likely want to sit at FWPM_LAYER{INBOUND / OUTBOUND}_TRANSPORT_V{4 / 6}.  Here you will be indicated the packet as the layerData.  You can look in the packet (at the transport header) to see if the ECE bit is set.

    Hope this helps,


    Dusty Harper [MSFT]
    Microsoft Corporation
    This posting is provided "AS IS", with NO warranties and confers NO rights
    Thursday, September 8, 2011 2:03 PM