Reply To: Query regarding socket

Home Forums Discussions Support Portal Query regarding socket Reply To: Query regarding socket

Vadim Smirnov

WinpkFilter works at the NDIS level, while socket is a high level abstraction, also for some packets (an example, routed packets) there can be no socket object at all.

Also, is there any way to get process metadata(process name, pid etc) using winpkfilter?

Yes, there is a way. You can use IP helper API to query active connections from the system and use protocol/IP/port information to match the packet against the connection and figure out the originating process.