locked
Packet buffering through WFP RRS feed

  • Question

  • Hi all,

    In the application I'm developing, I need to buffer a few packets (Layer 3 or lower) before deciding how each packet is processed (i.e., forward, drop). I'm new to WFP, is there any way to achieve this? or is WFP like firewall hook in DDK, whcih allows user programs to "see" only one packet when the callback funtion is invoked?

    Thanks.

    Wednesday, April 16, 2008 4:05 AM

Answers

  • Install the lastest Vista SP1 DDK (or WS08 DDK) and you will find a "Inspect" sample under src\network\trans. The sample demonstrates how to defer packet & connection filtering at both ALE and TRANSPORT layers to be processed later by a worker thread.

     

    WFP will indicate packets to callouts as long as the TCP/IP stack had received them.

     

    Thanks,

    Biao.W.

    Wednesday, April 16, 2008 9:24 PM