Metadata fields at each filtering layer
The following table lists the possible metadata fields that are available by layer. Some fields are available only under specific circumstances. For example, the metadata field FWPS_METADATA_FIELD_FRAGMENT_DATA is available for inbound IP packet layers only if the packet is fragmented. Layers that are not listed in the table do not have any available metadata fields.
| Run-time filtering layer identifier | Metadata fields |
|---|---|
|
FWPS_LAYER_INBOUND_IPPACKET_V4 FWPS_LAYER_INBOUND_IPPACKET_V6 |
FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_FRAGMENT_DATA |
|
FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_FRAGMENT_DATA |
|
FWPS_LAYER_OUTBOUND_IPPACKET_V4 FWPS_LAYER_OUTBOUND_IPPACKET_V6 |
FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_FRAGMENT_DATA FWPS_METADATA_FIELD_PATH_MTU |
|
FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_FRAGMENT_DATA FWPS_METADATA_FIELD_PATH_MTU |
|
FWPS_LAYER_IPFORWARD_V4 FWPS_LAYER_IPFORWARD_V6 |
FWPS_METADATA_FIELD_COMPARTMENT_ID |
|
FWPS_LAYER_IPFORWARD_V4_DISCARD FWPS_LAYER_IPFORWARD_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_COMPARTMENT_ID |
|
FWPS_LAYER_INBOUND_TRANSPORT_V4 FWPS_LAYER_INBOUND_TRANSPORT_V6 |
FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ALE_CLASSIFY_REQUIRED FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE |
|
FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ALE_CLASSIFY_REQUIRED FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE |
|
FWPS_LAYER_OUTBOUND_TRANSPORT_V4 FWPS_LAYER_OUTBOUND_TRANSPORT_V6 |
FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA FWPS_METADATA_FIELD_REMOTE_SCOPE_ID FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE |
|
FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA FWPS_METADATA_FIELD_REMOTE_SCOPE_ID FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE |
|
FWPS_LAYER_STREAM_V4 FWPS_LAYER_STREAM_V6 |
FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_SYSTEM_FLAGS |
|
FWPS_LAYER_STREAM_V4_DISCARD FWPS_LAYER_STREAM_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_SYSTEM_FLAGS |
|
FWPS_LAYER_DATAGRAM_DATA_V4 FWPS_LAYER_DATAGRAM_DATA_V6 |
FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA FWPS_METADATA_FIELD_REMOTE_SCOPE_ID FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE |
|
FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA FWPS_METADATA_FIELD_REMOTE_SCOPE_ID FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE |
|
FWPS_LAYER_INBOUND_ICMP_ERROR_V4 FWPS_LAYER_INBOUND_ICMP_ERROR_V6 |
FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE |
|
FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE |
|
FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6 |
FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA FWPS_METADATA_FIELD_REMOTE_SCOPE_ID |
|
FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA FWPS_METADATA_FIELD_REMOTE_SCOPE_ID |
|
FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 |
FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_COMPLETION_HANDLE FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_COMPLETION_HANDLE FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_AUTH_LISTEN_V4 FWPS_LAYER_ALE_AUTH_LISTEN_V6 |
FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_COMPLETION_HANDLE FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_COMPLETION_HANDLE FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6 |
FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_COMPLETION_HANDLE FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_PACKET_DIRECTION FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_COMPLETION_HANDLE FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_PACKET_DIRECTION FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_AUTH_CONNECT_V4 FWPS_LAYER_ALE_AUTH_CONNECT_V6 |
FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_COMPLETION_HANDLE FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_REMOTE_SCOPE_ID FWPS_METADATA_FIELD_PACKET_DIRECTION FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_COMPLETION_HANDLE FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_REMOTE_SCOPE_ID FWPS_METADATA_FIELD_PACKET_DIRECTION FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4 FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6 |
FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD |
FWPS_METADATA_FIELD_DISCARD_REASON FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_PROCESS_PATH FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_RESERVED FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_INBOUND_MAC_FRAME_802_3 |
FWPS_METADATA_FIELD_ETHER_FRAME_LENGTH |
|
FWPS_LAYER_ALE_RESOURCE_RELEASE_V4 FWPS_LAYER_ALE_RESOURCE_RELEASE_V6 |
FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V4 FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V6 |
FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_CONNECT_REDIRECT_V4 FWPS_LAYER_ALE_CONNECT_REDIRECT_V6 |
FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE FWPS_METADATA_FIELD_LOCAL_REDIRECT_TARGET_PID FWPS_METADATA_FIELD_REDIRECT_RECORD_HANDLE FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_ALE_BIND_REDIRECT_V4 FWPS_LAYER_ALE_BIND_REDIRECT_V6 |
FWPS_METADATA_FIELD_TOKEN FWPS_METADATA_FIELD_PROCESS_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_LOCAL_REDIRECT_TARGET_PID FWPS_METADATA_FIELD_SUB_PROCESS_TAG |
|
FWPS_LAYER_STREAM_PACKET_V4 FWPS_LAYER_STREAM_PACKET_V6 |
FWPS_METADATA_FIELD_FLOW_HANDLE FWPS_METADATA_FIELD_IP_HEADER_SIZE FWPS_METADATA_FIELD_SYSTEM_FLAGS FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE FWPS_METADATA_FIELD_COMPARTMENT_ID FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA FWPS_METADATA_FIELD_REMOTE_SCOPE_ID |
|
FWPS_LAYER_INGRESS_VSWITCH_ETHERNET FWPS_LAYER_EGRESS_VSWITCH_ETHERNET |
FWPS_L2_METADATA_FIELD_ETHERNET_MAC_HEADER_SIZE FWPS_L2_METADATA_FIELD_WIFI_OPERATION_MODE FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_PORT_ID FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_NIC_INDEX FWPS_L2_METADATA_FIELD_VSWITCH_PACKET_CONTEXT FWPS_L2_METADATA_FIELD_VSWITCH_DESTINATION_PORT_ID |
|
FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V4 FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V6 FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V4 FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V6 |
FWPS_L2_METADATA_FIELD_WIFI_OPERATION_MODE FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_PORT_ID FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_NIC_INDEX FWPS_L2_METADATA_FIELD_VSWITCH_PACKET_CONTEXT FWPS_L2_METADATA_FIELD_VSWITCH_DESTINATION_PORT_ID |
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for