Query on Filtering Capabilities in Windows Packet Filter API

Dear Olivier,

Yes, the Windows Packet Filter (WinpkFilter) API indeed supports advanced filtering capabilities that can be utilized to process packets meeting specific IP and port conditions. This can be achieved using WinpkFilter’s built-in static filters, which provide control over which packets are captured or redirected for user-mode processing based on defined criteria.

To streamline packet capture for specific conditions (such as ip=172.31.* and tcp.dstport==80), you can use static filters to target only the packets that match your designated IP range and port number. An example demonstrating basic static filter usage can be found here.

Please feel free to reach out for more examples or further guidance.

Best regards,
Vadim

Hello Olivier,

Yes, flags are supported. Please see the definition of the TCP filter below. Note that it’s an exact match, so you may need multiple filters to cover all desired flag combinations for SYN, SYN-ACK, RST, and FIN.

/**
* @brief TCPUDP_FILTER structure is used to set the TCP/UDP filter for the network adapter.
*
* @param m_ValidFields This field stores the valid fields flags. These flags determine which fields in the structure are valid. The flags
* can be a combination of the following values: TCPUDP_SRC_PORT, TCPUDP_DEST_PORT, TCPUDP_TCP_FLAGS.
* @param m_SourcePort This field is a PORT_RANGE structure that stores the source port range for the filter.
* @param m_DestPort This field is a PORT_RANGE structure that stores the destination port range for the filter.
* @param m_TCPFlags This field stores the TCP flags for the filter. It is an unsigned char representing the TCP flags combination.
*/
typedef struct _TCPUDP_FILTER
{
#define TCPUDP_SRC_PORT 0x00000001
#define TCPUDP_DEST_PORT 0x00000002
#define TCPUDP_TCP_FLAGS 0x00000004
DWORD m_ValidFields; // Specifies which of the fields below contain valid values and should be matched against the packet
PORT_RANGE m_SourcePort; // Source port
PORT_RANGE m_DestPort; // Destination port
unsigned char m_TCPFlags; // TCP flags combination
unsigned char Padding[3];
} TCPUDP_FILTER, * PTCPUDP_FILTER;

// 4.3 Check TCP flags
if (pFilter->m_Filter.m_TransportFilter.m_TcpUdp.m_ValidFields & TCPUDP_TCP_FLAGS)
{
if (pTcpHdr->th_flags != pFilter->m_Filter.m_TransportFilter.m_TcpUdp.m_TCPFlags)
{
dwFilterIndex++;
pFilter = (PSTATIC_FILTER_LIST_ITEM)pFilter->m_qLink.Flink;
continue;
}
}