FAST PACKET INJECTION

Overview

The Fast Packet Injection scenario will clone the packet and
inject it back to the same layer.  No
modification is performed on the packet.

All filters added sit in WFPSampler's
sublayer (which is weighted just below IPsec's sublayer), unless otherwise
specified using the -sl
<SUBLAYER> command line option.
All filters are associated with WFPSampler's
provider.

This scenario is meant to display the performance impact of
injection.  There is no guarantee that
the injection will succeed for certain packets (loopback, IPsec, etc.).  All injection is performed synchronously
(inline) from within the ClassifyFastPacketInjection().
Memory is only allocated in the case of outbound transport.

CompleteFastPacketInjection() will indicate the final status of the packet’s injection.  This function will also free any allocated
memory.

The following diagram shows how the code flows for this
callout:

Figure A. Code flow for Fast Packet Injection Scenario

Applicable Layers

v
FWPM_LAYER_INBOUND_IPPACKET_V4

v
FWPM_LAYER_INBOUND_IPPACKET_V6

v
FWPM_LAYER_OUTBOUND_IPPACKET_V4

v
FWPM_LAYER_OUTBOUND_IPPACKET_V6

v
FWPM_LAYER_IPFORWARD_V4

v
FWPM_LAYER_IPFORWARD_V6

v
FWPM_LAYER_INBOUND_TRANSPORT_V4

v
FWPM_LAYER_INBOUND_TRANSPORT_V6

v
FWPM_LAYER_OUTBOUND_TRANSPORT_V4

v
FWPM_LAYER_OUTBOUND_TRANSPORT_V6

v
FWPM_LAYER_DATAGRAM_DATA_V4

v
FWPM_LAYER_DATAGRAM_DATA_V6

v
FWPM_LAYER_INBOUND_ICMP_ERROR_V4

v
FWPM_LAYER_INBOUND_ICMP_ERROR_V6

v
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4

v
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6

v
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v
FWPM_LAYER_ALE_AUTH_CONNECT_V4

v
FWPM_LAYER_ALE_AUTH_CONNECT_V6

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6

v
FWPM_LAYER_STREAM_PACKET_V4                                     (Win7+)

v
FWPM_LAYER_STREAM_PACKET_V6                                     (Win7+)

v
FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET       (Win8+)

v
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET   (Win8+)

v
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE            (Win8+)

v
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE        (Win8+)

v
FWPM_LAYER_INGRESS_VSWITCH_ETHERNET                  (Win8+)

v
FWPM_LAYER_EGRESS_VSWITCH_ETHERNET                    (Win8+)

Command Line Usage

Option

Argument

Meaning

-s

FAST_PACKET_INJECTION

Implement the FAST_PACKET_INJECTION scenario

-l

Applicable Layer

Layer at which this filter will apply

-sl

Applicable subLayer

SubLayer to associate with the filter.  [default is
WFPSAMPLER_SUBLAYER].

-v

Make the objects associated with this scenario’s instance dynamic

-b

Make the objects associated with this scenario’s instance available
during boot-time

-r

Remove objects associated with this scenario instance

-?

Display help

“WFPSampler.Exe -s
FAST_PACKET_INJECTION -?“
provides help output

“WFPSampler.Exe -s
FAST_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v“ adds a dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout.  This filter will have no conditions, meaning
it will act on all traffic seen at this layer.

“WFPSampler.Exe -s
FAST_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v -r“ removes (-r)
the dynamic filter (-v) at
FWPM_LAYER_INBOUND_IPPACKET_V4 (-l)
which references the appropriate callout.

“WFPSampler.Exe -s
FAST_PACKET_INJECTION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -ipla
1.0.0.1 -ipra 1.0.0.254“ adds
a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout.  This filter will have 2 conditions;
FWPM_CONDITION_IP_LOCAL_ADDRESS (-ipla) equals 1.0.0.1, and
FWPM_CONDITION_IP_REMOTE_ADDRESS (-ipra) equals 1.0.0.254.

For a list of conditions applicable to each layer, refer to Filtering
Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring each
condition, refer to Conditions
for Command Line.