WFP user mode management functions

  • Article

The semantics of the Windows Filtering Platform user-mode management functions are exactly the same when called from a callout driver as when called from a user-mode application, except that the return type is an NTSTATUS code instead of a Win32 error code.

These functions are documented in the Management Functions section of the user-mode WFP Functions documentation.

Note

The kernel-mode version of each function is defined in fwpmk.h. The user-mode version of each function is defined in fwpmu.h.

Callers of all of these functions except FwpmFreeMemory0 must be running at IRQL = PASSIVE_LEVEL. Callers of FwpmFreeMemory0 must be running at IRQL <= DISPATCH_LEVEL.

Callout Management

Connection Object Management

Event Management

Filter Management

Layer Management

Provider Context Management

Provider Management

Session Management

Sublayer Management

Transaction Management

vSwitch Management