I have a driver implementing 2 callouts for both FWPM_LAYER_INBOUND and OUTBOUND layers,ipv4. I need information about the underlying prootocol, let say ethernet. Do you know if it is possible without hooking the ndis layer?
Thanks,
I don't know about supported, but I did notice during my development of a WFP callout that the ethernet frame header was at the very beginning of the NBL indicated to my callout on the inbound layers. I think you may be out of luck on outbound, however, as the ethernet headers would not have been constructed yet...
Hope this helps,
Jeremy
Lower headers like ethernet are not supported by wfp. You may still need to implement an NDIS driver for that.
I noticed the presence of the ethernet headers for the inbound layers,
but your are right about outbound. Anyway, it is not supported by the
wfp plateform, so will continue to work with ndis for all the underlying
layer.
Thanks,
Fabien,
What exactly are you looking for in the ethernet headers, any particular information? also what are the scenarios that you are thinking of targetting by filtering on ethernet headers?
-Jaydeep.
Sorry for my late reply.
I am porting a firewall under Vista, that is able to filter
frame according to their phyisical headers contents, such
as ethernet address...
Thanks,
Fabien.
