Has anyone tried to filter ipnat.sys? I have a machine that is using
internet connection sharing and I have an NDIS IM driver monitoring the
public interface. My IM driver sees NAT'd addresses and I need to associate
these addresses to the original addresses.
I've seen some stuff on the net about a user mode API which you can use to
query the NAT table that ipnat.sys maintains, but I want to do this in kernel
mode - perhaps by filtering the interface between tcpip.sys and ipnat.sys.
Perhaps I can use a TDI driver to do this, or perhaps I can get my IM driver
to send IOCTRL's directly to ipnat.sys to query the NAT table.
Any suggestions?