BASIC PACKET
EXAMINATION

Overview

The Basic Packet Examination scenario will log the packet’s
headers at that layer by parsing the NBL and using ETW tracing.  This is performed inline.  For this scenario, no injection occurs.

All filters added sit in FWPM_SUBLAYER_INSPECTION.  All filters are associated with WFPSampler’s provider.

The following diagram shows how the code flows for this
callout:

Figure A. Code flow for Basic Packet Examination Scenario

When traffic matches a filter at the specified layer, ClassifyBasicPacketExamination() is invoked by the Filtering
Engine.  This function creates the
CLASSIFY_DATA and invokes the appropriate performFn.

Each of the performFns are tailored to log the headers for their layer using ETW
tracing.  The main need for multiple performFns in this scenario is due to the data offset and
information available at each layer.
Within the performFn, the offset of the
original NBL is manipulated to get to the appropriate header, after which, the
logging function is invoked.  When
logging has finished, the data offset is adjusted to the next header.  Before exiting the performFn,
the data offset is returned to the original position.

When the performFn is finished,
the classifyFn is allowed to continue.  The classifyFn will
set the action to FWP_ACTION_CONTINUE, and exit.

Applicable Layers

v
FWPM_LAYER_INBOUND_IPPACKET_V4

v
FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD

v
FWPM_LAYER_INBOUND_IPPACKET_V6

v
FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD

v
FWPM_LAYER_OUTBOUND_IPPACKET_V4

v
FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD

v
FWPM_LAYER_OUTBOUND_IPPACKET_V6

v
FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD

v
FWPM_LAYER_IPFORWARD_V4

v
FWPM_LAYER_IPFORWARD_V4_DISCARD

v
FWPM_LAYER_IPFORWARD_V6

v
FWPM_LAYER_IPFORWARD_V6_DISCARD

v
FWPM_LAYER_INBOUND_TRANSPORT_V4

v
FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD

v
FWPM_LAYER_INBOUND_TRANSPORT_V6

v
FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD

v
FWPM_LAYER_OUTBOUND_TRANSPORT_V4

v
FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD

v
FWPM_LAYER_OUTBOUND_TRANSPORT_V6

v
FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD

v
FWPM_LAYER_STREAM_V4

v
FWPM_LAYER_STREAM_V4_DISCARD

v
FWPM_LAYER_STREAM_V6

v
FWPM_LAYER_STREAM_V6_DISCARD

v
FWPM_LAYER_DATAGRAM_DATA_V4

v
FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD

v
FWPM_LAYER_DATAGRAM_DATA_V6

v
FWPM_LAYER_DATAGRAM_DATA_V6_DISCARD

v
FWPM_LAYER_INBOUND_ICMP_ERROR_V4

v
FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD

v
FWPM_LAYER_INBOUND_ICMP_ERROR_V6

v
FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD

v
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4

v
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD

v
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6

v
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD

v
FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4

v
FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD

v
FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6

v
FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD

v
FWPM_LAYER_ALE_AUTH_LISTEN_V4

v
FWPM_LAYER_ALE_AUTH_LISTEN_V4_DISCARD

v
FWPM_LAYER_ALE_AUTH_LISTEN_V6

v
FWPM_LAYER_ALE_AUTH_LISTEN_V6_DISCARD

v
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD

v
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD

v
FWPM_LAYER_ALE_AUTH_CONNECT_V4

v
FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD

v
FWPM_LAYER_ALE_AUTH_CONNECT_V6

v
FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD

v
FWPM_LAYER_ALE_RESOURCE_RELEASE_V4                   (Win7+)

v
FWPM_LAYER_ALE_RESOURCE_RELEASE_V6                   (Win7+)

v
FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4                  (Win7+)

v
FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V6                  (Win7+)

v
FWPM_LAYER_ALE_CONNECT_REDIRECT_V4                  (Win7+)

v
FWPM_LAYER_ALE_CONNECT_REDIRECT_V6                  (Win7+)

v
FWPM_LAYER_ALE_BIND_REDIRECT_V4                           (Win7+)

v
FWPM_LAYER_ALE_BIND_REDIRECT_V6                           (Win7+)

v
FWPM_LAYER_STREAM_PACKET_V4                                     (Win7+)

v
FWPM_LAYER_STREAM_PACKET_V6                                     (Win7+)

v
FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET       (Win8+)

v
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET   (Win8+)

v
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE            (Win8+)

v
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE        (Win8+)

v
FWPM_LAYER_INGRESS_VSWITCH_ETHERNET                  (Win8+)

v
FWPM_LAYER_EGRESS_VSWITCH_ETHERNET                    (Win8+)

v
FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4      (Win8+)

v
FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6      (Win8+)

v
FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4        (Win8+)

v
FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6        (Win8+)

Command Line Usage

Option

Argument

Meaning

-s

BASIC_PACKET_EXAMINATION

Implement the BASIC_PACKET_EXAMINATION scenario

-l

Applicable Layer

Layer at which this filter will apply

-v

Make the objects associated with this scenario’s instance dynamic

-b

Make the objects associated with this scenario’s instance available
during boot-time

-r

Remove objects associated with this scenario instance

-?

Display help

“WFPSampler.Exe -s
BASIC_PACKET_EXAMINATION -?“
provides help output

“WFPSampler.Exe -s
BASIC_PACKET_EXAMINATION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v“  adds a dynamic
filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the
appropriate callout.  This filter will
have no conditions, meaning it will act on all traffic seen at this layer.

“WFPSampler.Exe -s
BASIC_PACKET_EXAMINATION -l FWPM_LAYER_INBOUND_IPPACKET_V4 –v -r“  removes (-r) the dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate
callout.

“WFPSampler.Exe -s BASIC_PACKET_EXAMINATION -l
FWPM_LAYER_INBOUND_TRANSPORT_V4  -ipla
1.0.0.1 –ipra 1.0.0.254 –ipp
TCP “ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4  (-l)
which references the appropriate callout.
This filter will have 3 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals
1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (-ipra) equals 1.0.0.254, and FWPM_CONDITION_IP_PROTOCOL  (-ipp) equals
TCP.

For a list of conditions applicable to each layer, refer to Filtering
Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring each
condition, refer to Conditions
for Command Line.

Notes

Traces

In order to get the traces, use a trace utility such as
TraceLog.exe and TraceFmt.exe

TraceLog.exe -start wfpsampler -guid #53504657-6d61-6c70-6572-5f496e746572
-f wfpsampler.etl -flags 0xFFFF -level 7

Run the scenario

TraceLog.exe -stop wfpsampler

TraceFmt.exe wfpsampler.etl
-pdb
<SYMBOLS.PRI_PATH>\WFPSamplerCalloutDriver_0x603.pdb  -o \WFPSampler.txt