Is WinpkFilter capable of tracking connections or it may only execute callbacks on per-packet basis?
We’re currently using WFP and when a flow ends it invokes our callout and passes a context which may contain arbitrary data. Can similar functionality be achieved using WinpkFilter?
Neither process nor the connection context are available on the NDIS level. However, it is still possible to use information extracted form the packet headers (IP/protocol/port) to match the packet against the local process information which can be requested using IP Helper API.