WinpkFilter: connection tracking?

[nijazz]

Hi Vadim,
Is WinpkFilter capable of tracking connections or it may only execute callbacks on per-packet basis?
We’re currently using WFP and when a flow ends it invokes our callout and passes a context which may contain arbitrary data. Can similar functionality be achieved using WinpkFilter?
Thank you.

[Vadim Smirnov]

Neither process nor the connection context are available on the NDIS level. However, it is still possible to use information extracted form the packet headers (IP/protocol/port) to match the packet against the local process information which can be requested using IP Helper API.

[Author]

Posts