Implementing the Capture Filter Code
After you determine how to organize your filter through a CAPTUREFILTER structure, you must allocate and fill in the structure, which is then passed to the Network Monitor driver through a configuration BLOB.
Direct NPP users add the capture filter to the configuration BLOB that is passed to Connect, Configure, or both. For a list of COM interfaces that you can use to communicate with the NPP, see NPP Interfaces.