Hi guys
I have read
Filtering Layer Identifiers
Filtering Conditions Available at Each Filtering Layer
Data Offset Positions (Windows Drivers)
How to get sourceInterfaceIndex at FWPM_LAYER_INBOUND_IPPACKET_V4
WFP: Layer and filter conditions to capture all packets?
WFP: Layer and filter conditions to capture all packets?
Appears in the WDK version 8.0, they have not found, so you can give me some hints to solve this problem.
More, as well as answers to people if you have questions about this
I try capture all packet . you can see and get me point the mistakes or lack , i need changed and addition
Code:
void Capture_Packet()
{
UINT32 status = NO_ERROR;
UINT32 count_packet = 0;
unsigned long ip_src, ip_des;
HANDLE engineHandle = 0;
FWPM_FILTER filter = {0};
FWPM_FILTER_CONDITION filterCondition = {0};
status = FwpmEngineOpen(0,RPC_C_AUTHN_WINNT, 0,0,&engineHandle);
if(status != NO_ERROR)
{
goto EXIT;
}
filter.displayData.name = L"Capture packet";
filter.layerKey = FWPM_LAYER_INBOUND_IPPACKET_V4;
//filter.layerKey = FWPM_LAYER_OUTBOUND_IPPACKET_V4;
filter.action.type = FWP_ACTION_PERMIT;
filter.weight.type = FWP_EMPTY;
filter.filterCondition = &filterCondition;
filter.numFilterConditions = 0; // 0 capture all packet
//filterCondition.fieldKey = FWPM_CONDITION_ALE_PROMISCUOUS_MODE;
//filterCondition.conditionValue.type = FWP_UINT32 ;
//filterCondition.conditionValue.uint8 = ???
status = FwpmFilterAdd(engineHandle,&filter,0,&(filter.filterId));
if(status != NO_ERROR)
{
goto EXIT;
}
// in this case : network LAN using Proxy-Server or Web-Proxy
// filter engine at Server ( LAN++++++Server++++++Internet )
//capture all packet in LAN before the packet processing and forwarding to Proxy.
for (UINT32 i=0 ; i < count_packet ; i++)
{
// printf("Packet : %d from IP source : %s to IP destination : %s \n" ,i, inet_toa(ip_src) ????,inet_toa(ip_des) ????);
}
EXIT:
//FwpmFilterDeleteById(engineHandle,filter.filterId);
FwpmEngineClose(engineHandle);
}
But it`s not working . i`m use Vs 2012 , WDK 8.0
Thank you so much.