WFP Callout Driver Data Field Identifiers (Compact 7)

Article
07/31/2017

3/12/2014

The following tables list the data field identifiers for each run-time filtering layer. These identifiers are constant values in the FWPS_FIELDS_XXX enumerations that are defined in Fwpsk.h.

WPS_LAYER_INBOUND_IPPACKET_V4

FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_INBOUND_IPPACKET_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_INBOUND_IPPACKET_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_INBOUND_IPPACKET_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_INBOUND_IPPACKET_V4_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_IPPACKET_V4_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

WPS_LAYER_INBOUND_IPPACKET_V6

FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_INBOUND_IPPACKET_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_INBOUND_IPPACKET_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_INBOUND_IPPACKET_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_INBOUND_IPPACKET_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_INBOUND_IPPACKET_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_INBOUND_IPPACKET_V6_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_IPPACKET_V6_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_OUTBOUND_IPPACKET_V4

FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_OUTBOUND_IPPACKET_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_OUTBOUND_IPPACKET_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_OUTBOUND_IPPACKET_V4_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_OUTBOUND_IPPACKET_V4_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_OUTBOUND_IPPACKET_V6

FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_OUTBOUND_IPPACKET_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_OUTBOUND_IPPACKET_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_OUTBOUND_IPPACKET_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_OUTBOUND_IPPACKET_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_OUTBOUND_IPPACKET_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_OUTBOUND_IPPACKET_V6_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_OUTBOUND_IPPACKET_V6_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_IPFORWARD_V4

FWPS_LAYER_IPFORWARD_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_IPFORWARD_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_IPFORWARD_V4_IP_DESTINATION_ADDRESS	The remote IP address
FWPS_FIELD_IPFORWARD_V4_IP_DESTINATION_ADDRESS_TYPE	The destination IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_IPFORWARD_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_IPFORWARD_V4_IP_FORWARD_INTERFACE	The LUID for the network interface on which the packet being forwarded is to be sent out.
FWPS_FIELD_IPFORWARD_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_IPFORWARD_V4_SOURCE_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_IPFORWARD_V4_SOURCE_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack
FWPS_FIELD_IPFORWARD_V4_DESTINATION_INTERFACE_INDEX	The index of the destination network interface, as enumerated by the network stack
FWPS_FIELD_IPFORWARD_V4_DESTINATION_SUB_INTERFACE_INDEX	The index of the destination logical network interface, as enumerated by the network stack

FWPS_LAYER_IPFORWARD_V6

FWPS_LAYER_IPFORWARD_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_IPFORWARD_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_IPFORWARD_V6_IP_DESTINATION_ADDRESS	The remote IP address
FWPS_FIELD_IPFORWARD_V6_IP_DESTINATION_ADDRESS_TYPE	The destination IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_IPFORWARD_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_IPFORWARD_V6_IP_FORWARD_INTERFACE	The LUID for the network interface on which the packet being forwarded is to be sent out.
FWPS_FIELD_IPFORWARD_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_IPFORWARD_V6_SOURCE_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_IPFORWARD_V6_SOURCE_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack
FWPS_FIELD_IPFORWARD_V6_DESTINATION_INTERFACE_INDEX	The index of the destination network interface, as enumerated by the network stack
FWPS_FIELD_IPFORWARD_V6_DESTINATION_SUB_INTERFACE_INDEX	The index of the destination logical network interface, as enumerated by the network stack

FWPS_LAYER_INBOUND_TRANSPORT_V4

FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_PROTOCOL	The IP protocol number, as specified in RFC 1700.
FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_LOCAL_PORT	The local transport protocol port number.
FWPS_FIELD_INBOUND_TRANSPORT_V4_IP_REMOTE_PORT	The remote transport protocol port number.
FWPS_FIELD_INBOUND_TRANSPORT_V4_ICMP_TYPE	The ICMP type field, as specified in RFC 792.
FWPS_FIELD_INBOUND_TRANSPORT_V4_ICMP_CODE	The ICMP code field, as specified in RFC 792.
FWPS_FIELD_INBOUND_TRANSPORT_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_INBOUND_TRANSPORT_V4_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_TRANSPORT_V4_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_INBOUND_TRANSPORT_V6

FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_INBOUND_TRANSPORT_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_INBOUND_TRANSPORT_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_INBOUND_TRANSPORT_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_INBOUND_TRANSPORT_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_INBOUND_TRANSPORT_V6_IP_PROTOCOL	The IP protocol number, as specified in RFC 1700.
FWPS_FIELD_INBOUND_TRANSPORT_V6_IP_LOCAL_PORT	The local transport protocol port number.
FWPS_FIELD_INBOUND_TRANSPORT_V6_IP_REMOTE_PORT	The remote transport protocol port number.
FWPS_FIELD_INBOUND_TRANSPORT_V6_ICMP_TYPE	The ICMP type field, as specified in RFC 792.
FWPS_FIELD_INBOUND_TRANSPORT_V6_ICMP_CODE	The ICMP code field, as specified in RFC 792.
FWPS_FIELD_INBOUND_TRANSPORT_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_INBOUND_TRANSPORT_V6_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_TRANSPORT_V6_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_OUTBOUND_TRANSPORT_V4

FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_DESTINATION_ADDRESS_TYPE	The destination IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_PROTOCOL	The IP protocol number, as specified in RFC 1700
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_IP_REMOTE_PORT	The remote transport protocol port number
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_OUTBOUND_TRANSPORT_V4_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_OUTBOUND_TRANSPORT_V6

FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_IP_DESTINATION_ADDRESS_TYPE	The destination IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_IP_PROTOCOL	The IP protocol number, as specified in RFC 1700
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_IP_REMOTE_PORT	The remote transport protocol port number
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_OUTBOUND_TRANSPORT_V6_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_STREAM_V4

FWPS_LAYER_STREAM_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_STREAM_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_STREAM_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_STREAM_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_STREAM_V4_IP_LOCAL_PORT	The local transport protocol port number.
FWPS_FIELD_STREAM_V4_IP_REMOTE_PORT	The remote transport protocol port number.
FWPS_FIELD_STREAM_V4_DIRECTION	The direction of the data flow. The possible values are as follows: FWP_DIRECTION_INBOUND FWP_DIRECTION_OUTBOUND
FWPS_FIELD_STREAM_V4_FLAGS	A bitwise OR of a combination of filtering condition flags

FWPS_LAYER_STREAM_V6

FWPS_LAYER_STREAM_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_STREAM_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_STREAM_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_STREAM_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_STREAM_V6_IP_LOCAL_PORT	The local transport protocol port number.
FWPS_FIELD_STREAM_V6_IP_REMOTE_PORT	The remote transport protocol port number.
FWPS_FIELD_STREAM_V6_DIRECTION	The direction of the data flow. The possible values are as follows: FWP_DIRECTION_INBOUND FWP_DIRECTION_OUTBOUND
FWPS_FIELD_STREAM_V6_FLAGS	A bitwise OR of a combination of filtering condition flags

FWPS_LAYER_DATAGRAM_DATA_V4

FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_DATAGRAM_DATA_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration
FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_DATAGRAM_DATA_V4_IP_PROTOCOL	The IP protocol number, as specified in RFC 1700
FWPS_FIELD_DATAGRAM_DATA_V4_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_DATAGRAM_DATA_V4_IP_REMOTE_PORT	The remote transport protocol port number
FWPS_FIELD_DATAGRAM_DATA_V4_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_DATAGRAM_DATA_V4_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_DATAGRAM_DATA_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_DATAGRAM_DATA_V4_DIRECTION	The direction of the datagram traffic. The possible values are as follows: FWP_DIRECTION_INBOUND FWP_DIRECTION_OUTBOUND
FWPS_FIELD_DATAGRAM_DATA_V4_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_DATAGRAM_DATA_V4_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_DATAGRAM_DATA_V6

FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_DATAGRAM_DATA_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_DATAGRAM_DATA_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_DATAGRAM_DATA_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration
FWPS_FIELD_DATAGRAM_DATA_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_DATAGRAM_DATA_V6_IP_PROTOCOL	The IP protocol number, as specified in RFC 1700
FWPS_FIELD_DATAGRAM_DATA_V6_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_DATAGRAM_DATA_V6_IP_REMOTE_PORT	The remote transport protocol port number
FWPS_FIELD_DATAGRAM_DATA_V6_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_DATAGRAM_DATA_V6_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_DATAGRAM_DATA_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_DATAGRAM_DATA_V6_DIRECTION	The direction of the datagram traffic. The possible values are as follows: FWP_DIRECTION_INBOUND FWP_DIRECTION_OUTBOUND
FWPS_FIELD_DATAGRAM_DATA_V6_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_DATAGRAM_DATA_V6_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack

FWPS_LAYER_INBOUND_ICMP_ERROR_V4

FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_INTERFACE_INDEX On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_INTERFACE_TYPE On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_TYPE	The encapsulation method that is used by a tunnel, if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by IANA.
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_ARRIVAL_INTERFACE On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V4_SUB_INTERFACE_INDEX	The LUID for the network interface associated with the arrival IP address
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_LOCAL_ADDRESS_TYPE	The local IP address type that is embedded in the ICMP packet. The possible condition values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_REMOTE_ADDRESS	The remote IP address that is embedded in the ICMP packet.
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_LOCAL_PORT	The local transport protocol port number that is embedded in the ICMP packet.
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_EMBEDDED_REMOTE_PORT	The remote transport protocol port number that is embedded in the ICMP packet
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_LOCAL_INTERFACE_INDEX On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_INDEX	The index of the local network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_ARRIVAL_SUB_INTERFACE_INDEX On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V4_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_LOCAL_INTERFACE_TYPE On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V4_INTERFACE_TYPE	The type of the local network interface, as defined by the Internet Assigned Numbers Authority (IANA)
FWPS_FIELD_INBOUND_ICMP_ERROR_V4_LOCAL_TUNNEL_TYPE On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V4_TUNNEL_TYPE	The encapsulation method that is used by a tunnel, if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by IANA.

FWPS_LAYER_INBOUND_ICMP_ERROR_V6

FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_ARRIVAL_INTERFACE_INDEX On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V6_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_ARRIVAL_INTERFACE_TYPE On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V6_INTERFACE_TYPE	The encapsulation method that is used by a tunnel, if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by IANA.
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_IP_ARRIVAL_INTERFACE On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V6_SUB_INTERFACE_INDEX	The LUID for the network interface associated with the arrival IP address
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_EMBEDDED_LOCAL_ADDRESS_TYPE	The local IP address type that is embedded in the ICMP packet. The possible condition values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_EMBEDDED_REMOTE_ADDRESS	The remote IP address that is embedded in the ICMP packet.
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_EMBEDDED_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_EMBEDDED_LOCAL_PORT	The local transport protocol port number that is embedded in the ICMP packet.
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_EMBEDDED_REMOTE_PORT	The remote transport protocol port number that is embedded in the ICMP packet
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_LOCAL_INTERFACE_INDEX On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V6_INTERFACE_INDEX	The index of the local network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_ARRIVAL_SUB_INTERFACE_INDEX On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V6_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_LOCAL_INTERFACE_TYPE On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V6_INTERFACE_TYPE	The type of the local network interface, as defined by the Internet Assigned Numbers Authority (IANA)
FWPS_FIELD_INBOUND_ICMP_ERROR_V6_LOCAL_TUNNEL_TYPE On Windows Vista: FWPS_FIELD_INBOUND_ICMP_ERROR_V6_TUNNEL_TYPE	The encapsulation method that is used by a tunnel, if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by IANA.

FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4

FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_INTERFACE_INDEX	The index of the local network interface, as enumerated by the network stack
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_INTERFACE_TYPE	The type of the arrival network interface, as defined by the Internet Assigned Numbers Authority (IANA)
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_TUNNEL_TYPE	The encapsulation method that is used by a tunnel, if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by IANA.
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V4_FLAGS	A bitwise OR of a combination of filtering condition flags

FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6

FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_INTERFACE_INDEX	The index of the local network interface, as enumerated by the network stack
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_SUB_INTERFACE_INDEX	The index of the logical network interface, as enumerated by the network stack
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_INTERFACE_TYPE	The type of the arrival network interface, as defined by the Internet Assigned Numbers Authority (IANA)
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_TUNNEL_TYPE	The encapsulation method that is used by a tunnel, if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by IANA.
FWPS_FIELD_OUTBOUND_ICMP_ERROR_V6_FLAGS	A bitwise OR of a combination of filtering condition flags

FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4

FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_USER_ID	The identifier of the local user
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_ALE_PROMISCUOUS_MODE	The raw socket mode that is allowed or denied. The possible values are as follows: SIO_RCVALL SIO_RCVALL_IGMPMCAST SIO_RCVALL_MCAST

Note

For the case of an implicit bind, the local address and port information might not be available. In this case, the FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_ADDRESS, FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_ADDRESS_TYPE, and/or FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V4_IP_LOCAL_PORT data fields might be of type FWP_EMPTY.

FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6

FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_IP_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_ALE_USER_ID	The identifier of the local user
FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_ALE_PROMISCUOUS_MODE	The raw socket mode that is allowed or denied. The possible values are as follows: SIO_RCVALL SIO_RCVALL_IGMPMCAST SIO_RCVALL_MCAST

Note

For the case of an implicit bind, the local address and port information might not be available. In this case, the FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_IP_LOCAL_ADDRESS, FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_IP_LOCAL_ADDRESS_TYPE, and/or FWPS_FIELD_ALE_RESOURCE_ASSIGNMENT_V6_IP_LOCAL_PORT data fields might be of type FWP_EMPTY.

FWPS_LAYER_ALE_AUTH_LISTEN_V4

FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_ALE_AUTH_LISTEN_V4_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_AUTH_LISTEN_V4_ALE_USER_ID	The identifier of the local user

FWPS_LAYER_ALE_AUTH_LISTEN_V6

FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_AUTH_LISTEN_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_AUTH_LISTEN_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_AUTH_LISTEN_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_ALE_AUTH_LISTEN_V6_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_ALE_AUTH_LISTEN_V6_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_AUTH_LISTEN_V6_ALE_USER_ID	The identifier of the local user

FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4

FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ARRIVAL_INTERFACE_INDEX On Windows Vista: FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_INTERFACE_INDEX	The index of the arrival network interface, as enumerated by the network stack
ARRIVAL_INTERFACE_TYPE On Windows Vista: FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_INTERFACE_TYPE	The type of the arrival network interface, as defined by the Internet Assigned Numbers Authority (IANA)
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ARRIVAL_TUNNEL_TYPE On Windows Vista: FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_TUNNEL_TYPE	The encapsulation method that is used by a tunnel, if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by IANA.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_ARRIVAL_INTERFACE On Windows Vista: FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_SUB_INTERFACE_INDEX	The LUID for the network interface associated with the arrival IP address
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type that is embedded in the ICMP packet. The possible condition values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ICMP_TYPE FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_LOCAL_PORT	The local transport protocol port number that is embedded in the ICMP packet.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ICMP_CODE FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_IP_REMOTE_PORT	The remote IP address that is embedded in the ICMP packet.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_USER_ID	The identifier of the local user
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_REMOTE_USER_ID	The identifier of the remote user
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_ALE_REMOTE_MACHINE_ID	The identifier of the remote machine
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_SIO_FIREWALL_SYSTEM_PORT	Reserved
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V4_NAP_CONTEXT	Reserved

Note

When an outgoing packet is indicated to this layer during a reauthorization call to the callout filter's classifyFn function, all arrival network interface related fields are set to FWP_EMPTY.

FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6

FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ARRIVAL_INTERFACE_INDEX On Windows Vista: FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_INTERFACE_INDEX	The index of the arrival network interface, as enumerated by the network stack
ARRIVAL_INTERFACE_TYPE On Windows Vista: FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_INTERFACE_TYPE	The type of the arrival network interface, as defined by the Internet Assigned Numbers Authority (IANA)
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ARRIVAL_TUNNEL_TYPE On Windows Vista: FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_TUNNEL_TYPE	The encapsulation method that is used by a tunnel, if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by IANA.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_IP_ARRIVAL_INTERFACE On Windows Vista: FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_SUB_INTERFACE_INDEX	The LUID for the network interface associated with the arrival IP address
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type that is embedded in the ICMP packet. The possible condition values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_IP_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ICMP_TYPE FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_IP_LOCAL_PORT	The local transport protocol port number that is embedded in the ICMP packet.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ICMP_CODE FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_IP_REMOTE_PORT	The remote IP address that is embedded in the ICMP packet.
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ALE_USER_ID	The identifier of the local user
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ALE_REMOTE_USER_ID	The identifier of the remote user
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_ALE_REMOTE_MACHINE_ID	The identifier of the remote computer
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_SIO_FIREWALL_SYSTEM_PORT	Reserved
FWPS_FIELD_ALE_AUTH_RECV_ACCEPT_V6_NAP_CONTEXT	Reserved

Note

When an outgoing packet is indicated to this layer during a reauthorization call to the callout filter's classifyFn function, all arrival network interface related fields are set to FWP_EMPTY.

FWPS_LAYER_ALE_AUTH_CONNECT_V4

FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_DESTINATION_ADDRESS_TYPE	The destination IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_ALE_AUTH_CONNECT_V4_IP_REMOTE_PORT	The report transport protocol port number
FWPS_FIELD_ALE_AUTH_CONNECT_V4_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_USER_ID	The identifier of the local user
FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_REMOTE_USER_ID	The identifier of the remote user
FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_REMOTE_MACHINE_ID	The identifier of the remote computer
FWPS_FIELD_ALE_AUTH_CONNECT_V4_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_ALE_AUTH_CONNECT_V4_SUB_INTERFACE_INDEX	The index of the network subinterface, as enumerated by the network stack

FWPS_LAYER_ALE_AUTH_CONNECT_V6

FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_AUTH_CONNECT_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_AUTH_CONNECT_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_ALE_AUTH_CONNECT_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_AUTH_CONNECT_V6_IP_DESTINATION_ADDRESS_TYPE	The destination IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_AUTH_CONNECT_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_ALE_AUTH_CONNECT_V6_IP_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_ALE_AUTH_CONNECT_V6_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_ALE_AUTH_CONNECT_V6_IP_REMOTE_PORT	The report transport protocol port number
FWPS_FIELD_ALE_AUTH_CONNECT_V6_FLAGS	A bitwise OR of a combination of filtering condition flags
FWPS_FIELD_ALE_AUTH_CONNECT_V6_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_AUTH_CONNECT_V6_ALE_USER_ID	The identifier of the local user
FWPS_FIELD_ALE_AUTH_CONNECT_V6_ALE_REMOTE_USER_ID	The identifier of the remote user
FWPS_FIELD_ALE_AUTH_CONNECT_V6_ALE_REMOTE_MACHINE_ID	The identifier of the remote computer
FWPS_FIELD_ALE_AUTH_CONNECT_V6_INTERFACE_INDEX	The index of the network interface, as enumerated by the network stack
FWPS_FIELD_ALE_AUTH_CONNECT_V6_SUB_INTERFACE_INDEX	The index of the network subinterface, as enumerated by the network stack

FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4

FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_DESTINATION_ADDRESS_TYPE	The destination IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_IP_REMOTE_PORT	The report transport protocol port number
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V4_DIRECTION	The direction of the data flow. The possible values are as follows: FWP_DIRECTION_INBOUND FWP_DIRECTION_OUTBOUND
FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_USER_ID	The identifier of the local user
FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_REMOTE_USER_ID	The identifier of the remote user
FWPS_FIELD_ALE_AUTH_CONNECT_V4_ALE_REMOTE_MACHINE_ID	The identifier of the remote computer
FWPS_FIELD_ALE_AUTH_CONNECT_V4_FLAGS	A bitwise OR of a combination of filtering condition flags

FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6

FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD

Data Field Identifier	Data Field Description
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_LOCAL_ADDRESS_TYPE	The local IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_DESTINATION_ADDRESS_TYPE	The destination IP address type. The possible values are defined by the NL_ADDRESS_TYPE enumeration.
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_LOCAL_INTERFACE	The LUID for the network interface associated with the local IP address.
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_PROTOCOL	The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_IP_REMOTE_PORT	The report transport protocol port number
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_ICMP_TYPE	The ICMP type field, as specified in RFC 792
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_ICMP_CODE	The ICMP code field, as specified in RFC 792
FWPS_FIELD_ALE_FLOW_ESTABLISHED_V6_DIRECTION	The direction of the data flow. The possible values are as follows: FWP_DIRECTION_INBOUND FWP_DIRECTION_OUTBOUND
FWPS_FIELD_ALE_AUTH_CONNECT_V6_ALE_APP_ID	The full path of the application
FWPS_FIELD_ALE_AUTH_CONNECT_V6_ALE_USER_ID	The identifier of the local user
FWPS_FIELD_ALE_AUTH_CONNECT_V6_ALE_REMOTE_USER_ID	The identifier of the remote user
FWPS_FIELD_ALE_AUTH_CONNECT_V6_ALE_REMOTE_MACHINE_ID	The identifier of the remote computer
FWPS_FIELD_ALE_AUTH_CONNECT_V6_FLAGS	A bitwise OR of a combination of filtering condition flags

FWPS_LAYER_IPSEC_KM_DEMUX_V4

Data Field Identifier	Data Field Description
FWPS_FIELD_IPSEC_KM_DEMUX_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_IPSEC_KM_DEMUX_V4_IP_REMOTE_ADDRESS	The remote IP address

FWPS_LAYER_IPSEC_KM_DEMUX_V6

Data Field Identifier	Data Field Description
FWPS_FIELD_IPSEC_KM_DEMUX_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_IPSEC_KM_DEMUX_V6_IP_REMOTE_ADDRESS	The remote IP address

FWPS_LAYER_IPSEC_V4

Data Field Identifier	Data Field Description
FWPS_FIELD_IPSEC_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_IPSEC_V4_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_IPSEC_V4_IP_PROTOCOL	The IP protocol number, as specified in RFC 1700
FWPS_FIELD_IPSEC_V4_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_IPSEC_V4_IP_REMOTE_PORT	The report transport protocol port number

FWPS_LAYER_IPSEC_V6

Data Field Identifier	Data Field Description
FWPS_FIELD_IPSEC_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_IPSEC_V6_IP_REMOTE_ADDRESS	The remote IP address
FWPS_FIELD_IPSEC_V6_IP_PROTOCOL	The IP protocol number, as specified in RFC 1700
FWPS_FIELD_IPSEC_V6_IP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_IPSEC_V6_IP_REMOTE_PORT	The report transport protocol port number

FWPS_LAYER_IKEEXT_V4

Data Field Identifier	Data Field Description
FWPS_FIELD_IKEEXT_V4_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_IKEEXT_V4_IP_REMOTE_ADDRESS	The remote IP address

FWPS_LAYER_IKEEXT_V6

Data Field Identifier	Data Field Description
FWPS_FIELD_IKEEXT_V6_IP_LOCAL_ADDRESS	The local IP address
FWPS_FIELD_IKEEXT_V6_IP_REMOTE_ADDRESS	The remote IP address

FWPS_LAYER_RPC_UM

Data Field Identifier	Data Field Description
FWPS_FIELD_RPC_UM_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_RPC_UM_REMOTE_USER_TOKEN	The identifier of the remote user
FWPS_FIELD_RPC_UM_IF_UUID	The UUID of the RPC interface
FWPS_FIELD_RPC_UM_IF_VERSION	The version of the RPC interface
FWPS_FIELD_RPC_UM_PROTOCOL	The RPC protocol. The possible condition values are as follows: RPC_PROTSEQ_TCP RPC_PROTSEQ_HTTP RPC_PROTSEQ_NMP
FWPS_FIELD_RPC_UM_IF_FLAG	Reserved
FWPS_FIELD_DCOM_APP_ID	The identification of the COM application
FWPS_FIELD_IMAGE_NAME	The name of the application
FWPS_FIELD_RPC_UM_AUTH_TYPE	The authentication service type
FWPS_FIELD_RPC_UM_AUTH_LEVEL	The authentication service level
FWPS_FIELD_RPC_UM_SEC_ENCRYPT_ALGORITHM	The certificate based security service provider interface (SSPI) encryption algorithm
FWPS_FIELD_RPC_UM_SEC_KEY_SIZE	The certificate based security service provider interface (SSPI) encryption key size
FWPS_FIELD_RPC_UM_LOCAL_ADDR_V4	The local IPv4 address
FWPS_FIELD_RPC_UM_LOCAL_ADDR_V6	The local IPv6 address
FWPS_FIELD_RPC_UM_PIPE	The name of the remote named pipe
FWPS_FIELD_RPC_UM_REMOTE_ADDR_V4	The remote IPv4 address
FWPS_FIELD_RPC_UM_REMOTE_ADDR_V6	The remote IPv6 address. The IPv6 address of the RPC client.

FWPS_LAYER_RPC_EPMAP

Data Field Identifier	Data Field Description
FWPS_FIELD_RPC_EPMAP_LOCAL_PORT	The local transport protocol port number
FWPS_FIELD_RPC_EPMAP_REMOTE_USER_TOKEN	The identifier of the remote user
FWPS_FIELD_RPC_EPMAP_IF_UUID	The UUID of the RPC interface
FWPS_FIELD_RPC_EPMAP_IF_VERSION	The version of the RPC interface
FWPS_FIELD_RPC_EPMAP_PROTOCOL	The RPC protocol. The possible condition values are as follows: RPC_PROTSEQ_TCP RPC_PROTSEQ_HTTP RPC_PROTSEQ_NMP
FWPS_FIELD_RPC_EPMAP_IF_FLAG	Reserved
FWPS_FIELD_RPC_EPMAP_AUTH_TYPE	The authentication service type
FWPS_FIELD_RPC_EPMAP_AUTH_LEVEL	The authentication service level
FWPS_FIELD_RPC_EPMAP_SEC_ENCRYPT_ALGORITHM	The certificate based security service provider interface (SSPI) encryption algorithm
FWPS_FIELD_RPC_EPMAP_SEC_KEY_SIZE	The certificate based security service provider interface (SSPI) encryption key size
FWPS_FIELD_RPC_EPMAP_LOCAL_ADDR_V4	The local IPv4 address
FWPS_FIELD_RPC_EPMAP_LOCAL_ADDR_V6	The local IPv6 address
FWPS_FIELD_RPC_EPMAP_PIPE	The name of the remote named pipe
FWPS_FIELD_RPC_EPMAP_REMOTE_ADDR_V4	The remote IPv4 address
FWPS_FIELD_RPC_EPMAP_REMOTE_ADDR_V6	The remote IPv6 address

FWPS_LAYER_RPC_EP_ADD

Data Field Identifier	Data Field Description
FWPS_FIELD_RPC_EP_ADD_PROTOCOL	The RPC protocol. The possible condition values are as follows: RPC_PROTSEQ_TCP RPC_PROTSEQ_HTTP RPC_PROTSEQ_NMP
FWPS_FIELD_RPC_EP_ADD_PROCESS_WITH_RPC_IF_UUID	The UUID of the process with the RPC interface
FWPS_FIELD_RPC_EP_ADD_EP_VALUE	Reserved
FWPS_FIELD_RPC_EP_ADD_EP_FLAGS	Reserved

FWPS_LAYER_RPC_PROXY_CONN

Data Field Identifier	Data Field Description
FWPS_FIELD_RPC_PROXY_CONN_CLIENT_TOKEN	The identification of the client when using RpcProxy
FWPS_FIELD_RPC_PROXY_CONN_SERVER_NAME	The name of the RPC server when using RpcProxy
FWPS_FIELD_RPC_PROXY_CONN_SERVER_PORT	The port on the RPC server when using RpcProxy
FWPS_FIELD_RPC_PROXY_CONN_PROXY_AUTH_TYPE	The RPC proxy authentication service type
FWPS_FIELD_RPC_PROXY_CONN_CLIENT_CERT_KEY_LENGTH	The secure socket layer (SSL) key length in the client certificate
FWPS_FIELD_RPC_PROXY_CONN_CLIENT_CERT_OID	The object identifier (also known as OID) in the client certificate

FWPS_LAYER_RPC_PROXY_IF

Data Field Identifier	Data Field Description
FWPS_FIELD_RPC_PROXY_IF_IF_UUID	The UUID of the RPC interface
FWPS_FIELD_RPC_PROXY_IF_IF_VERSION	The version of the RPC interface
FWPS_FIELD_RPC_PROXY_IF_CLIENT_TOKEN	The identification of the client when using RpcProxy
FWPS_FIELD_RPC_PROXY_IF_SERVER_NAME	The name of the RPC server when using RpcProxy
FWPS_FIELD_RPC_PROXY_IF_SERVER_PORT	The port on the RPC server when using RpcProxy
FWPS_FIELD_RPC_PROXY_IF_PROXY_AUTH_TYPE	The RPC proxy authentication service type
FWPS_FIELD_RPC_PROXY_IF_CLIENT_CERT_KEY_LENGTH	The secure socket layer (SSL) key length in the client certificate
FWPS_FIELD_RPC_PROXY_IF_CLIENT_CERT_OID	The object identifier (OID) in the client certificate

Remarks

An enumeration constant value ending in _MAX is a maximum value that is used for testing.

Share via

WFP Callout Driver Data Field Identifiers (Compact 7)

Remarks

See Also

Reference

Other Resources

Additional resources