So I did a memory dump on the Filter Table and mapped it out:
Filter Table:
02 00 00 00 – Table Size
00 00 00 00 00 00 00 00 – m_Adapter
03 00 00 00 – m_dwDirectionFlags
03 00 00 00 – m_FilterAction
06 00 00 00 – m_ValidFields
00 00 00 00 – m_LastReset
00 00 00 00 00 00 00 00 – m_PacketsIn
00 00 00 00 00 00 00 00 – m_BytesIn
00 00 00 00 00 00 00 00 – m_PacketsOut
00 00 00 00 00 00 00 00 – m_BytesOut (56)
DATA_LINK_LAYER_FILTER
00 00 00 00 – m_dwUnionSelector
ETH_802_3_FILTER
00 00 00 00 – m_ValidFields
00 00 00 00 00 00 – m_SrcAddress
00 00 00 00 00 00 – m_DestAddress
00 00 – m_Protocol
00 00 – Padding (24)
NETWORK_LAYER_FILTER
01 00 00 00 – m_dwUnionSelector
IP_V4_FILTER
04 00 00 00 – m_ValidFields
00 00 00 00 00 00 00 00
00 00 00 00 – m_SrcAddress
00 00 00 00 00 00 00 00
00 00 00 00 – m_DestAddress
11 – m_Protocol
00 00 00 – Padding
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 – Padding (84)
TRANSPORT_LAYER_FILTER
01 00 00 00 – m_dwUnionSelector
TCPUDP_FILTER
02 00 00 00 – m_ValidFields
00 00 – m_StartRange
00 00 – m_EndRange
35 00 – m_StartRange
35 00 – m_EndRange
00 – m_TCPFlags (17)
** 00 00 00 – ? **
00 00 00 00 00 00 00 00 – m_Adapter
03 00 00 00 – m_dwDirectionFlags
01 00 00 00 – m_FilterAction
00 00 00 00 – m_ValidFields
00 00 00 00 – m_LastReset
00 00 00 00 00 00 00 00 – m_PacketsIn
00 00 00 00 00 00 00 00 – m_BytesIn
00 00 00 00 00 00 00 00 – m_PacketsOut
00 00 00 00 00 00 00 00 – m_BytesOut (56)
DATA_LINK_LAYER_FILTER
00 00 00 00 – m_dwUnionSelector
ETH_802_3_FILTER
00 00 00 00 – m_ValidFields
00 00 00 00 00 00 – m_SrcAddress
00 00 00 00 00 00 – m_DestAddress
00 00 – m_Protocol
00 00 – Padding (24)
NETWORK_LAYER_FILTER
00 00 00 00 – m_dwUnionSelector
IP_V4_FILTER
00 00 00 00 – m_ValidFields
00 00 00 00 00 00 00
00 00 00 00 – m_SrcAddress
00 00 00 00 00 00 00
00 00 00 00 – m_DestAddress
00 – m_Protocol
00 00 00 – Padding
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 – Padding (84)
TRANSPORT_LAYER_FILTER
00 00 00 00 – m_dwUnionSelector
TCPUDP_FILTER
00 00 00 00 – m_ValidFields
00 00 – m_StartRange
00 00 – m_EndRange
00 00 – m_StartRange
00 00 – m_EndRange
00 – m_TCPFlags (17)
00 00 00 – ?
00 00 00 00 00 00 00 00 – m_Adapter
00 00 00 00 – m_dwDirectionFlags
00 00 00 00 – m_FilterAction
00 00 00 00 – m_ValidFields
00 00 00 00 – m_LastReset
00 00 00 00 00 00 00 00 – m_PacketsIn
00 00 00 00 00 00 00 00 – m_BytesIn
00 00 00 00 00 00 00 00 – m_PacketsOut
00 00 00 00 00 00 00 00 – m_BytesOut (56)
DATA_LINK_LAYER_FILTER
00 00 00 00 – m_dwUnionSelector
ETH_802_3_FILTER
00 00 00 00 – m_ValidFields
00 00 00 00 00 00 – m_SrcAddress
00 00 00 00 00 00 – m_DestAddress
00 00 – m_Protocol
00 00 – Padding (24)
NETWORK_LAYER_FILTER
00 00 00 00 – m_dwUnionSelector
IP_V4_FILTER
00 00 00 00 – m_ValidFields
00 00 00 00 00 00 00 00
00 00 00 00 – m_SrcAddress
00 00 00 00 00 00 00 00
00 00 00 00 – m_DestAddress
00 – m_Protocol
00 00 00 – Padding
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 – Padding (84)
TRANSPORT_LAYER_FILTER
00 00 00 00 – m_dwUnionSelector
TCPUDP_FILTER
00 00 00 00 – m_ValidFields
00 00 – m_StartRange
00 00 – m_EndRange
00
Total Bytes (547)
The individual Static Filters each reported the correct length (181), and the table itself with space allocated for 3 Static Filters reported the correct length (547). But the second filter was installed on a word boundary leaving 3 extra bytes between the first and second static filters.
Could this be causing the failure to install the filter table?
J.A. Coutts