locked
WFP incorrect behaviour in Windows 7 RRS feed

  • Question

  • Hello

     Recently I found out an incorrect behavior of my WFP driver in Windows 7 environment. I set callouts at FWPS_OUTBOUND_IPPACKET_V4 and FWPS_OUTBOUND_IPPACKET_V6 and process ICMP requests asynchronously - clone net buffer list and inject data from the system thread at passive level IRQL. In the injection completion routine net buffer list has status STATUS_NOT_ACCEPTED for IPv6 ping command. I statred my driver in Vista, but didn't reproduce a problem described. 
     In order to clarify the failure reason, I found out that internal TCPIP function WfpAleConnectAcceptIndicate returned STATUS_ACCESS_DENIED. Why?

     Please consider a problem and tell me, how to solve it.

     

    Regards, FraterSaturni

      

    Friday, June 25, 2010 7:35 AM

All replies

  • I was unable to reproduce the failed scenario.

    Is it possible that you have other filters on the machine which are causing the drop?  Can you run "NetSh.exe WFP Capture Start", repro the issue, and then run "NetSh.exe WFP Capture Stop"  In this you will likely see a Net Event for the drop.

    Hope this helps


    Dusty Harper [MSFT]
    Microsoft Corporation
    ------------------------------------------------------------
    This posting is provided "AS IS", with NO warranties and confers NO rights
    ------------------------------------------------------------
    Monday, June 28, 2010 7:32 PM
    Moderator