时间戳

首页 > 解决方案 > IGMP WFP 过滤条件

windows - IGMP WFP 过滤条件

问题描述

我正在开发一个 WFP 驱动程序来检测 IGMP 数据包并获取相同的副本以进行分析。我能够过滤 ICMP 但不能过滤 IGMP 数据包，希望 IGMP 和 ICMP 的过滤器配置没有太大变化。添加过滤器配置的代码片段，是否有任何特定的方法可用于过滤 IGMP 或我缺少的任何过滤器配置？..

filter.displayData.name = EXAMPLE_FILTER_NAME;
     filter.displayData.description = EXAMPLE_FILTER_DESCRIPTION;
     filter.action.type = FWP_ACTION_CALLOUT_INSPECTION;    
     filter.subLayerKey = EXAMPLE_SUBLAYER_GUID;
     filter.weight.type = FWP_UINT8;
     filter.weight.uint8 = 0xf;        
     filter.numFilterConditions = 1;    
     filter.layerKey = FWPM_LAYER_INBOUND_TRANSPORT_V4;    
     filter.action.calloutKey = EXAMPLE_CALLOUT_GUID;
    
     // IGMP protocol filter condition
     fwpConditions[0].fieldKey = FWPM_CONDITION_IP_PROTOCOL;
     fwpConditions[0].matchType = FWP_MATCH_EQUAL;
     fwpConditions[0].conditionValue.type = FWP_UINT8;
     fwpConditions[0].conditionValue.uint8 = IPPROTO_IGMP;
     filter.filterCondition = fwpConditions;
 status = FwpmFilterAdd(filter_engine_handle, &filter, NULL, &(example_filter_id));
 if (status != STATUS_SUCCESS){
     DbgPrint("Failed to register example filter, status 0x%08x", status);
 }
 else{
     DbgPrint("Example filter registered");
 }

标签： windowswfp

解决方案

推荐阅读