IGMP WFP filter condition.

Raghu GS 6 Reputation points
2021-08-01T05:51:22.113+00:00

Hi all,

I am developing a WFP driver to detect IGMP packets and take a copy of the same for analysis purpose. I am able to filter ICMP but not the IGMP packet, Hope there isn't much change b/w the filter config of IGMP & ICMP. Adding the code snippet of filter config, Is there any specific way to follow for filtering IGMP or any filter config i am missing?..

 filter.displayData.name = EXAMPLE_FILTER_NAME;
 filter.displayData.description = EXAMPLE_FILTER_DESCRIPTION;
 filter.action.type = FWP_ACTION_CALLOUT_INSPECTION;
 filter.subLayerKey = EXAMPLE_SUBLAYER_GUID;
 filter.weight.type = FWP_UINT8;
 filter.weight.uint8 = 0xf;
 filter.numFilterConditions = 1;
 filter.layerKey = FWPM_LAYER_INBOUND_TRANSPORT_V4;
 filter.action.calloutKey = EXAMPLE_CALLOUT_GUID;

 // IGMP protocol filter condition
 fwpConditions[0].fieldKey = FWPM_CONDITION_IP_PROTOCOL;
 fwpConditions[0].matchType = FWP_MATCH_EQUAL;
 fwpConditions[0].conditionValue.type = FWP_UINT8;
 fwpConditions[0].conditionValue.uint8 = IPPROTO_IGMP;

    filter.filterCondition = fwpConditions;
    status = FwpmFilterAdd(filter_engine_handle, &filter, NULL, &(example_filter_id));
    if (status != STATUS_SUCCESS){
        DbgPrint("Failed to register example filter, status 0x%08x", status);
    }
    else{
       DbgPrint("Example filter registered");
    }
Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,684 questions
{count} vote

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.