Built-in Callout Identifiers

The identifiers for the callout functions that are built in to the Windows Filtering Platform (WFP) are each represented by a GUID. These identifiers are defined as follows.

The V4 and V6 suffixes at the end of the callout identifiers indicate whether the callout is for the IPv4 network stack or for the IPv6 network stack.

FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4 / FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6

Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.

This callout is applicable at the transport layer.

FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4 / FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6

Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.

This callout is applicable at the transport layer.

FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4 / FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6

Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.

This callout is applicable at the transport layer.

FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4 / FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6

Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.

This callout is applicable at the transport layer.

FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4 / FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6

Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.

This callout is applicable at the forwarding layer.

FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4 / FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6

Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.

This callout is applicable at the forwarding layer.

FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V4 / FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V6

Verifies that each incoming connection that is supposed to arrive secure arrives securely.

This callout is applicable at the ALE accept layer.

FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V4 / FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V6

Permits the IPsec tunnel mode IP-in-IP packets when they get classified at the ALE accept layer.

FWPM_CALLOUT_IPSEC_ALE_CONNECT_V4 / FWPM_CALLOUT_IPSEC_ALE_CONNECT_V6

Applies IPsec policy modifiers to client applications.

FWPM_CALLOUT_IPSEC_DOSP_FORWARD_V4 / FWPM_CALLOUT_IPSEC_DOSP_FORWARD_V6

Signals to IPsec DoS Protection that traffic needs to be verified for potential DoS and may need to be rate limited.

Note

Available only in Windows 7 and Windows Server 2008 R2.

FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP / FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP

Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.

This callout is applicable at the inbound transport discard layer.

FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V4 / FWPM_CALLOUT_TCP_CHIMNEY_CONNECT_LAYER_V6

Enables or disables TCP chimney offload for each outgoing connection.

FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V4 / FWPM_CALLOUT_TCP_CHIMNEY_ACCEPT_LAYER_V6

Enables or disables TCP chimney offload for each incoming connection.

FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V4 / FWPM_CALLOUT_SET_OPTIONS_AUTH_CONNECT_LAYER_V6

Sets classify options on outbound flows.

FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V4 / FWPM_CALLOUT_SET_OPTIONS_AUTH_RECV_ACCEPT_LAYER_V6

Sets classify options on inbound flows.

Note

Available only in Windows 8 and Windows Server 2012.

FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V4 / FWPM_CALLOUT_RESERVED_AUTH_CONNECT_LAYER_V6

This identifier is reserved for internal use.

FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V6 / FWPM_CALLOUT_TEREDO_ALE_LISTEN_V6

Signals to the Teredo service that an application requires a Teredo address.

Note

For Windows 7 and later, use FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V6.

FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V6 / FWPM_CALLOUT_TEREDO_ALE_RESOURCE_ASSIGNMENT_V6

Signals to the Teredo service that an application requires a Teredo address.

Note

For Windows 7 and later, use FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V6.

FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_RESOURCE_ASSIGNMENT_V4

This identifier is reserved for future use.

FWPM_CALLOUT_EDGE_TRAVERSAL_ALE_LISTEN_V4

This identifier is reserved for future use.

FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V4 / FWPM_CALLOUT_TCP_TEMPLATES_CONNECT_LAYER_V6

Applies TCP template settings for matching outgoing connections.

Note

Available only in Windows 8 and Windows Server 2012.

FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V4 / FWPM_CALLOUT_TCP_TEMPLATES_ACCEPT_LAYER_V6

Applies TCP template settings for matching incoming connections.

Note

Available only in Windows 8 and Windows Server 2012.

Requirements

Requirement	Value
Minimum supported client	Windows Vista [desktop apps only]
Minimum supported server	Windows Server 2008 [desktop apps only]
Header	Fwpmu.h