Share via

WFP Filtering Condition Identifiers (Compact 7)

  • Article

3/12/2014

The Windows Filtering Platform (WFP) filtering condition identifiers are each represented by a GUID. The data type for the condition value for each filtering condition is defined as an FWP_DATA_TYPE. These identifiers and their data types are defined in the following tables.

Each of the following filtering conditions is available only as a subset of the WFP filtering layers. For more information on the availability of each condition at any given layer, see WFP Filtering Conditions Available at Each Filtering Layer.

General Filtering Condition Description

FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX

The index of the arrival network interface, as enumerated by the network stack.

Data type: FWP_UINT32

FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE

The type of the arrival network interface as defined by the Internet Assigned Names Authority (IANA).

Possible values: The interface type values listed in the Ipifcons.h header file.

Data type: FWP_UINT32

FWPM_CONDITION_ARRIVAL_SUB_INTERFACE_INDEX FWPM_CONDITION_SUB_INTERFACE_INDEX

The index of the logical network interface, as enumerated by the network stack.

Data type: FWP_UINT32

FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE

The encapsulation method used by a tunnel if the Type member is IF_TYPE_TUNNEL. The tunnel type is defined by the Internet Assigned Names Authority (IANA).

Possible values: The TUNNEL_TYPE enumeration type values listed in the Ifdef.h header file.

Data type: FWP_UINT32

FWPM_CONDITION_DESTINATION_INTERFACE_INDEX

The index of the destination network interface for forwarded packets, as enumerated by the network stack.

Data type: FWP_UINT32

FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX

The index of the destination logical network interface for forwarded packets, as enumerated by the network stack.

Data type: FWP_UINT32

FWPM_CONDITION_DIRECTION

The direction of the datagram traffic or data flow.

For datagram layer, this is the direction of the packet.

For stream layer, it is the direction of the connection. (For example, when a local application initiates the connection, an inbound packet has FWPM_CONDITION_DIRECTION set to outbound.)

Possible values:

  • FWP_DIRECTION_INBOUND
  • FWP_DIRECTION_OUTBOUND

Data type: FWP_UINT32

FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE

The local IP address type that is embedded in the ICMP packet.

Possible values: Any of the following NL_ADDRESS_TYPE enumeration values.

  • NlatUnspecified
  • NlatUnicast
  • NlatAnycast
  • NlatMulticast
  • NlatBroadcast

Data type: FWP_UINT8

FWPM_CONDITION_EMBEDDED_LOCAL_PORT

The local transport protocol port number that is embedded in the ICMP packet.

Data type: FWP_UINT16

FWPM_CONDITION_EMBEDDED_PROTOCOL

The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.

Data type: FWP_UINT8

FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS

The remote IP address that is embedded in the ICMP packet.

Data type: For an IPv4 address

  • FWP_V4_ADDR_MASK, or
  • FWP_UINT32

Data type: For an IPv6 address

  • FWP_V6_ADDR_MASK, or
  • FWP_BYTE_ARRAY16_TYPE

FWPM_CONDITION_EMBEDDED_REMOTE_PORT

The remote transport protocol port number that is embedded in the ICMP packet.

Data type: FWP_UINT16

FWPM_CONDITION_FLAGS

A bitwise OR of a combination of filtering condition flags.

Possible values: See topic WFP Filtering Condition Flags

Data type: FWP_UINT32

FWPM_CONDITION_ICMP_CODE

The ICMP code field, as specified in RFC 792.

Data type: FWP_UINT16

FWPM_CONDITION_ICMP_TYPE

The ICMP type field, as specified in RFC 792.

Data type: FWP_UINT16

FWPM_CONDITION_IP_ARRIVAL_INTERFACE

The LUID for the network interface associated with the arrival IP address.

Data type: FWP_UINT64

FWPM_CONDITION_IP_DESTINATION_ADDRESS

The destination IP address for forwarded packets.

Data type: For an IPv4 address

  • FWP_V4_ADDR_MASK, or
  • FWP_UINT32

Data type: For an IPv6 address

  • FWP_V6_ADDR_MASK, or
  • FWP_BYTE_ARRAY16_TYPE

FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE

The destination IP address type for forwarded packets.

Possible values: Any of the following NL_ADDRESS_TYPE enumeration values.

  • NlatUnspecified
  • NlatUnicast
  • NlatAnycast
  • NlatMulticast
  • NlatBroadcast

Data type: FWP_UINT8

FWPM_CONDITION_IP_FORWARD_INTERFACE

The LUID for the network interface on which the packet being forwarded is to be sent out.

Data type: FWP_UINT64

FWPM_CONDITION_IP_LOCAL_ADDRESS

The local IP address.

Data type: For an IPv4 address

  • FWP_V4_ADDR_MASK, or
  • FWP_UINT32

Data type: For an IPv6 address

  • FWP_V6_ADDR_MASK, or
  • FWP_BYTE_ARRAY16_TYPE

FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE

The local IP address type.

Possible values: Any of the following NL_ADDRESS_TYPE enumeration values.

  • NlatUnspecified
  • NlatUnicast
  • NlatAnycast
  • NlatMulticast
  • NlatBroadcast

Data type: FWP_UINT8

FWPM_CONDITION_IP_LOCAL_ADDRESS_V4

The local IPv4 address.

Data type:

  • FWP_V4_ADDR_MASK, or
  • FWP_UINT32

FWPM_CONDITION_IP_LOCAL_ADDRESS_V6

The local IPv6 address.

Data type:

  • FWP_V6_ADDR_MASK, or
  • FWP_BYTE_ARRAY16_TYPE

FWPM_CONDITION_IP_LOCAL_INTERFACE

The LUID for the network interface associated with the local IP address.

Data type: FWP_UINT64

FWPM_CONDITION_IP_LOCAL_PORT

The local transport protocol port number.

Data type: FWP_UINT16

FWPM_CONDITION_IP_PROTOCOL

The IP protocol number, as specified in RFC 1700.

Data type: FWP_UINT8

FWPM_CONDITION_IP_REMOTE_ADDRESS

The remote IP address.

Data type: For an IPv4 address

  • FWP_V4_ADDR_MASK, or
  • FWP_UINT32

Data type: For an IPv6 address

  • FWP_V6_ADDR_MASK, or
  • FWP_BYTE_ARRAY16_TYPE

FWPM_CONDITION_IP_REMOTE_ADDRESS_V4

The remote IPv4 address.

Data type:

  • FWP_V4_ADDR_MASK, or
  • FWP_UINT32

FWPM_CONDITION_IP_REMOTE_ADDRESS_V6

The remote IPv6 address.

Data type:

  • FWP_V6_ADDR_MASK, or
  • FWP_BYTE_ARRAY16_TYPE

FWPM_CONDITION_IP_REMOTE_PORT

The remote transport protocol port number.

Data type: FWP_UINT16

FWPM_CONDITION_IP_SOURCE_ADDRESS

The source IP address for forwarded packets.

Data type: For an IPv4 address

  • FWP_V4_ADDR_MASK, or
  • FWP_UINT32

Data type: For an IPv6 address

  • FWP_V6_ADDR_MASK, or
  • FWP_BYTE_ARRAY16_TYPE

FWPM_CONDITION_INTERFACE_INDEX

The index of the network interface, as enumerated by the network stack.

Data type: FWP_UINT32

FWPM_CONDITION_INTERFACE_TYPE

The interface type as defined by the Internet Assigned Names Authority (IANA).

Possible values: The interface type values listed in the Ipifcons.h header file.

Data type: FWP_UINT32

FWPM_CONDITION_TUNNEL_TYPE

The encapsulation method used by a tunnel if the Type member is IF_TYPE_TUNNEL. The tunnel type is defined by the Internet Assigned Names Authority (IANA).

Possible values: The TUNNEL_TYPE enumeration type values listed in the Ifdef.h header file.

Data type: FWP_UINT32

FWPM_CONDITION_SCOPE_ID

The interface IPv6 scope identifier. Reserved for internal use.

Data type: FWP_UINT32

FWPM_CONDITION_SOURCE_INTERFACE_INDEX

The index of the source network interface for forwarded packets, as enumerated by the network stack.

Data type: FWP_UINT32

FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX

The index of the source logical network interface for forwarded packets, as enumerated by the network stack.

Data type: FWP_UINT32

Remarks

When IP addresses are stored as an FWP_UINT32 data type, or when an IP port number is stored as an FWP_UINT16 data type, they are stored in host order, not network order.

See Also

Reference

WFP Filtering Conditions
FWP_DATA_TYPE
WFP Filtering Conditions Available at Each Filtering Layer

Other Resources

Windows Filtering Platform