it is a long time not to login this board. Today,I saw a new face about your product bbs!

from 3.0.1,winpkfilter use the new method&rules to do with the packets.
we known,put the every ring 0's packet to ring3 is very some slow or delay(that is the 2.0.4)!so i can write a winpkfilter protocol rule,then tell the sys: u must filter the pakcet in the .sys,i dont need these packets.is it used the filter buffers.

ok!see to look nice.but if it is to be performace a firewall which will deny much of much pakcets.yeah,great much! is it to say like this: winpkfilter will feel tired on do the large filters for every incoming packet!

and,at the first,the filter buffers had fixed the total size. when reached the end of the size(the last filter buffer),how could be add more filter rules? to "new" a new buffer and join with the old buffer?

becase i dont known how much filter rules which i need,I feel confuse! i am afriad sometime it is make used of all the filter rules buffer.

in these days,i plan to buy one winpkfiler,and i will contract in the email! thx.!

_________________
~~~~12

If you look at the definition below _STATIC_FILTER_TABLE can contain any number of filters (ANY_SIZE is defined as 1) specified in the m_TableSize. Of course you got to have enough free kernel memory to keep large table.