please do not say me though the winpkfilter data. How can i handle that though the gernal ip-header or tcp-header?
You can try to match Ethernet/IP address information (an example, source MAC == local NIC MAC ==> outgoing), but this does not give any guarantee because it is possible to send an arbitrary packet on the network.