BASIC PACKET EXAMINATION

Overview

The Basic Packet Examination scenario will log the pac= ket’s headers at that layer by parsing the NBL and using ETW tracing. This is performed inline. For this scenario, no injection occurs.=

All filters added sit in FWPM_SUBLAYER_INSPECTION. All filters are associated with WFPSampler’s provider.

The following diagram shows how the code flows for this callout:

Figure A. Code flow for Basic Packet Examination Scenario<= /span>

When traffic matches a filter at the specified layer, = ClassifyBasicPacketExamination() is invoked by the Filtering Engine. This function creates the CLASSIFY_DATA and invokes the appropriate performFn.

Each of the performFns are tailored to log the headers for their layer using = ETW tracing. The main need for multipl= e performFns in this scenario is due to the data offset= and information available at each layer. Within the performFn, the offset of the original NBL is manipulated to get to the appropriate header, after which, = the logging function is invoked. When logging has finished, the data offset is adjusted to the next header. Before exiting the performFn, the data offset is returned to the original position.

When the performFn is fini= shed, the classifyFn is allowed to continue. The classifyFn will set the action to FWP_ACTION_CONTINUE, and exit.

Applicable Layers

v FWPM_LAYER_INBOUND_IPPACKET_V4

v FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD<= /o:p>

v FWPM_LAYER_INBOUND_IPPACKET_V6

v FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD

v FWPM_LAYER_OUTBOUND_IPPACKET_V4

v FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD=

v FWPM_LAYER_OUTBOUND_IPPACKET_V6

v FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD

v FWPM_LAYER_IPFORWARD_V4

v FWPM_LAYER_IPFORWARD_V4_DISCARD

v FWPM_LAYER_IPFORWARD_V6

v FWPM_LAYER_IPFORWARD_V6_DISCARD

v FWPM_LAYER_INBOUND_TRANSPORT_V4

v FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD

v FWPM_LAYER_INBOUND_TRANSPORT_V6

v FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD

v FWPM_LAYER_OUTBOUND_TRANSPORT_V4

v FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD

v FWPM_LAYER_OUTBOUND_TRANSPORT_V6<= /p>

v FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD

v FWPM_LAYER_STREAM_V4

v FWPM_LAYER_STREAM_V4_DISCARD

v FWPM_LAYER_STREAM_V6

v FWPM_LAYER_STREAM_V6_DISCARD

v FWPM_LAYER_DATAGRAM_DATA_V4

v FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD

v FWPM_LAYER_DATAGRAM_DATA_V6

v FWPM_LAYER_DATAGRAM_DATA_V6_DISCARD

v FWPM_LAYER_INBOUND_ICMP_ERROR_V4

v FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD

v FWPM_LAYER_INBOUND_ICMP_ERROR_V6

v FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6

v FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD

v FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4

v FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCAR= D

v FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6

v FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCAR= D

v FWPM_LAYER_ALE_AUTH_LISTEN_V4

v FWPM_LAYER_ALE_AUTH_LISTEN_V4_DISCARD

v FWPM_LAYER_ALE_AUTH_LISTEN_V6

v FWPM_LAYER_ALE_AUTH_LISTEN_V6_DISCARD

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6

v FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD

v FWPM_LAYER_ALE_AUTH_CONNECT_V4

v FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD

v FWPM_LAYER_ALE_AUTH_CONNECT_V6

v FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6

v FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD

v FWPM_LAYER_ALE_RESOURCE_RELEASE_V4 (Win7+)

v FWPM_LAYER_ALE_RESOURCE_RELEASE_V6 (Win7+)

v FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V4 (Win7+)

v FWPM_LAYER_ALE_ENDPOINT_CLOSURE_V6 (Win7+)

v FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 (Win7+)

v FWPM_LAYER_ALE_CONNECT_REDIRECT_V6 (Win7+)

v FWPM_LAYER_ALE_BIND_REDIRECT_V4 = (Win7+)

v FWPM_LAYER_ALE_BIND_REDIRECT_V6 = (Win7+)

v FWPM_LAYER_STREAM_PACKET_V4 (Win7+= )

v FWPM_LAYER_STREAM_PACKET_V6 (Win7+= )

v FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET (Win8+)

v FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_ETHERNET (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_ETHERNET (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V4 (Win8+)

v FWPM_LAYER_INGRESS_VSWITCH_TRANSPORT_V6 (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V4 (Win8+)

v FWPM_LAYER_EGRESS_VSWITCH_TRANSPORT_V6 (Win8+)

Command Line Usage

Option	Argument	Meaning
-s	BASIC_PACKET_EXAMINATION	Implement the BASIC_PACKET_EXAMINATION scenario
-l	Applicable Layer	Layer at which this filter will apply
-v		Make the objects associated with this scenario’s instance dynamic=
-b		Make the objects associated with this scenario’s instance availab= le during boot-time
-r		Remove objects associated with this scenario instance
-?		Display help

“WFPSampler.E= xe -s BASIC_PACKET_EXAMINATION -?“ provides help output

“WFPSampler.E= xe -s BASIC_PACKET_EXAMINATION -l FWPM_LAYER_INBOUND_IPPACKET_V4 -v“ adds a dyna= mic filter (-v) at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout. This filter w= ill have no conditions, meaning it will act on all traffic seen at this layer.<= /p>

“WFPSampler.E= xe -s BASIC_PACKET_EXAMINATION -l FWPM_LAYER_INBOUND_IPPACKET_V4 –v -r“ removes (-r) the dynamic filter (-v) at FWPM_LAYER_INBOUND_IPPACKE= T_V4 (-l) which references the appropri= ate callout.

“WFPSampler.Exe -s BASIC_PACKET_EXAMINATION -l FWPM_LAYER_INBOUND_TRANSPORT_V4 -ipla 1.0.0.1 –ipra 1.0.0.254 –i= pp TCP “ adds a persistent filter at FWPM_LAYER_INBOUND_IPPACKET_V4 (-l) which references the appropriate callout. This filter will have 3 conditions; FWPM_CONDITION_IP_LOCAL_ADDRESS = (-ipla= ) equals 1.0.0.1, FWPM_CONDITION_IP_REMOTE_ADDRESS (-ipra) equals 1.0.0.254, and FWPM_CONDITION_IP_PROTOCOL (-ipp)= equals TCP.

For a list of conditions applicable to each layer, ref= er to Filtering Conditions Available at Each Filtering Layer.

For a list of command line parameters for configuring = each condition, refer to Co= nditions for Command Line.

Notes

Traces

In order to get the traces, use a trace utility such as TraceLog.exe and TraceFmt.exe

TraceLog.exe -start wfpsampler -guid #5350465= 7-6d61-6c70-6572-5f496e746572 -f wfpsampler.etl -flags 0xFFFF -level 7

Run the scenario

TraceLog.exe -stop wfpsampler

TraceFmt.exe wfpsampler.etl -pdb <SYMBOLS.PRI_PATH>\WFPSamplerCalloutDriver_0x603.= pdb -o \WFPSampler.txt