FWPS Callouts, usages and references

Question

I wanted to know the deep understanding of how Filter Drivers works. What is the detail and usages?

for example: FwpsCalloutRegister FwpmTransactionBegin FwpmSubLayerAdd FwpmCalloutAdd these are functions that used in many of network driver samples. Is there any reference to see how is order or what is the fundemental of filter drivers?

What is the usage of FwpmSubLayer ?

Answer 1

Read the documentation:

• User Mode: https://learn.microsoft.com/en-us/windows/win32/fwp/windows-filtering-platform-start-page
• Kernel Mode: https://learn.microsoft.com/en-us/windows-hardware/drivers/network/windows-filtering-platform-callout-drivers2