As I learned from WinpkFilter, filtering can be done in 3 different layers, Data Link, Network and Transport.
My question is when Network or Transport filter applied is the packet still in the Ethernet frame or been decapsulated? Is filtering is faster on Data Link other than Network and Transport?