Hello,
Hopefully this is the place to post this. I'm trying out the vista beta 2
and the WDK 5384 and learning to write a driver as I go.
So I'm trying to get up to speed with a new task at work and I'm stumped at
this point. Maybe someone out there has an answer to this. I've looked
through the WDK documentation and I'm still frustrated.
I'm supposed to investigate writing a kernel mode driver to run on vista
that will log IP traffic.
I create the classifyfn, noifyfn and flowdeletefn, create the FWPS_CALLOUT0
structure and register it successfully.
I know the filter engine is running based on the call to FwpmBfeStateGet0()
call.
I create an FWPM_CALLOUT0 structure and provite it with the key that is my
callout, the layer (I picked FWPM_LAYER_INBOUND_TRANSPORT_V4, but I've tried
a few others as well), and call FwpmCalloutAdd0() successfully.
All that *seems* fine, but I must be missing something here as my classifyFn
is never called. I would have expected it to get called at some point when I
had IP traffic.
Has anyone done anything such as this? I'm still trying to get my hands
around this problem. It was my assumption that filter engine would then
automatically call my classifyFn and then I could process the info at that
point. Am I missing something?
Thanks in advance for your advice.