Overview of the WFP Packet Modification Sample (ddproxy)
mainThe ddproxy sample is a kernel-mode Windows Filtering Platform (WFP) callout driver (Ddproxy.sys) that acts as a transparent redirector for UDP and non-error ICMP traffic.
Key Features:
- Redirection: For outbound traffic, it redirects to a new destination address and (for UDP) a new port. For inbound traffic, it redirects back to the original values.
- Protocol Support: Supports both IPv4 and IPv6.
- Out-of-band Modification: Uses a system worker thread with a
reference-drop-clone-modify-reinjectmechanism. This allows modification decisions to be made outside of the initialclassifyFn()callout, which is useful if decisions must be made by a user-mode application.