Filtering condition L2 flags

The filtering condition L2 flags are each represented by a bit field. These flags are defined as follows:

Filtering condition flag Description

FWP_CONDITION_L2_IS_NATIVE_ETHERNET

0x00000001

Tests if the data passed to a callout driver describes a native Ethernet packet.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE

Tests if the data passed to a callout driver describes a WIFI packet.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE

FWP_CONDITION_L2_IS_WIFI

0x00000002

Tests if the data passed to a callout driver describes a native Wi-Fi packet.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE

FWP_CONDITION_L2_IS_MOBILE_BROADBAND

0x00000004

Tests if the data passed to a callout driver describes a mobile broadband packet.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE

FWP_CONDITION_L2_IS_WIFI_DIRECT_DATA

0x00000008

Tests if the data passed to a callout driver describes a WIFI direct data packet.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE

FWP_CONDITION_L2_IS_VM2VM

0x00000010

Tests if the data passed to a callout driver describes a native virtual machine to virtual machine packet.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE

FWP_CONDITION_L2_IS_MALFORMED_PACKET

0x00000020

Tests if the data passed to a callout driver describes a malformed Ethernet packet.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE

FWP_CONDITION_L2_IS_IP_FRAGMENT_GROUP

0x00000040

Tests if the data passed to a callout driver describes a part of an IP fragment group.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE

FWP_CONDITION_L2_IF_CONNECTOR_PRESENT

0x00000080

Tests if a network interface connector is present on the underlying network adapter.

This flag should be set for a physical adapter.

This flag is applicable at the following filtering layers in Windows 8, Windows Server 2012, and later versions of Windows:

FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_OUTBOUND_MAC_FRAME_ETHERNET
FWPM_LAYER_INBOUND_MAC_FRAME_NATIVE
FWPM_LAYER_OUTBOUND_MAC_FRAME_NATIVE