now I have two systems one NDIS system to tunnel packets which are allowed and a TDI system which creates a connection/processID table.
the table is used in the NDIS system to check if the packet is allowed for the process.
the problem is the NDIS system gets the packets faster than the TDI system….can it be?
the TDI system catches the following events:
but the NDIS system looks after the port before the tdi system catches the create socket event….
I saves the connections by localport because the localport can only used by one process…..