- Article
- 12 minutes to read
Each of the Windows Filtering Platform (WFP) filter condition identifiers is represented by aGUID. The data type for the condition value for each filter condition is specified as aFWP_DATA_TYPE. These identifiers and their data types are defined here.
Standard conditions are listed first, followed by user mode specific conditions. Conditions are grouped by supported operating system so that you can easily find out which conditions are supported by a specific operating system.
Use
Each of the following filter conditions is only available at a subset of the WFP filter levels. For more information about the availability of each condition at a specific level, seeFilter conditions available at each filter level.
Terms available for Windows 8 and Windows Server 2012 | Description |
---|---|
| The MAC address of a specific local interface. Data type:FWP_BYTE_ARRAY6_TYPE |
| Destination address of an input frame or source address of an output frame. Data type:FWP_BYTE_ARRAY6_TYPE |
| Source address of an input frame or destination address of an output frame. Data type:FWP_BYTE_ARRAY6_TYPE |
| The Ethernet V2 network payload type. (See ETHERNET_TYPE_IPV4 etc. in netiodef.h.) Data type:FWP_UINT16 |
| The 16 bits of the VLAN header, including the VID, CFI, and priority fields, as per the 802.1q standard (see VLAN_TAG in netiodef.h for bit field locations). Data type:FWP_UINT16 |
| Unique identifier for the vSwitch network. Cannot be used in conjunction with VLAN_ID. Data type:FWP_UINT16 |
| The NDIS port number. Data type:FWP_UINT32 |
| The NDIS port media type. Data type:FWP_UINT32 Possible values:any of theNDIS_MIDDLEenumeration values. (See ntddndis.h.) |
| The NDIS port media type. Data type:FWP_UINT32 Possible values:any of theNDIS_PHYSICAL_MEDIUMenumeration values. (See ntddndis.h.) |
| A bitwise OR of a combination of filter condition flags. Data type:FWP_UINT32 Possible values:
|
| The address type of the physical local address. Data type:FWP_UINT8 Possible values:one of the followingDL_ADDRESS_TYPEenumeration values.
|
| The address type of the remote physical address. Data type:FWP_UINT8 Possible values:one of the followingDL_ADDRESS_TYPEenumeration values.
|
| The physical source address of a frame. Data type:FWP_BYTE_ARRAY6_TYPE |
| The physical destination address of a frame. Data type:FWP_BYTE_ARRAY6_TYPE |
| The address type of the physical destination address. Data type:FWP_UINT8 Possible values:one of the followingDL_ADDRESS_TYPEenumeration values.
|
| The address type of the physical destination address. Data type:FWP_UINT8 Possible values:one of the followingDL_ADDRESS_TYPEenumeration values.
|
| The source port for transporting packets. Data type:FWP_UINT16 |
| The ICMP type field as specified in RFC 792. Data type:FWP_UINT16 |
| The packet transport destination port. Data type:FWP_UINT16 |
| The ICMP code field as specified in RFC 792. Data type:FWP_UINT16 |
| Unique identifier for a vSwitch instance. Data type:FWP_BYTE_BLOB_TYPE |
| Indicates whether the vSwitch instance is part of an external, internal, or private virtual network. Data type:FWP_UINT8 |
| Unique identifier of the source of the current package. (The name of a VM NIC, P-NIC, or V-NIC.) Data type:FWP_BYTE_BLOB_TYPE |
| Unique identifier of the current packet's destination. (The name of a VM NIC, P-NIC, or V-NIC.) Data type:FWP_BYTE_BLOB_TYPE |
| Unique identifier of the source vSwitch virtual machine. Data type:FWP_BYTE_BLOB_TYPE |
| Unique identifier of the vSwitch target VM. Data type:FWP_BYTE_BLOB_TYPE |
| The interface type of the current package repository. Data type:FWP_UINT8 Possible values:
|
| Current packet destination interface type. Data type:FWP_UINT8 Possible values:
|
| The LUID for the network interface associated with the local IP address. Data type:FWP_UINT64 |
| The security identifier (SID) of an application container. Data type:FWP_SID |
| The full device path of the application, for example, "\device0\hardiskvolume1\Program Files\Application.exe". If a connection was redirected, this is the original application identifier; otherwise it is the same asFWPM_CONDITION_ALE_APP_ID. Data type:FWP_BYTE_BLOB_TYPE |
Conditions available for Windows 7, Windows Server 2008 R2 and later versions | Description |
---|---|
| The IP address of the next hop interface. Data type:FWP_V4_ADDR_MASK |
| The next-hop interface from which the packet originates. Data type:FWP_UINT64 |
| The interface type of the next hop interface. Data type:FWP_UINT32 |
| The tunnel type of the next-hop interface. Data type:FWP_UINT32 |
| The interface index of the next hop interface. Data type:FWP_UINT32 |
| The subinterface index of the next hop interface. Data type:FWP_UINT32 |
| The network category of the inbound or next hop interface over which the ALE flow is created (inbound or outbound). Data type:FWP_UINT32 |
| The network category of the incoming or next-hop interface upon which the current packet (inbound or outbound) is built. Data type:FWP_UINT32 |
| The network category of the delivery interface. Data type:FWP_UINT32 |
| The network category of the incoming interface. Data type:FWP_UINT32 |
| The network category of the next-hop interface. Data type:FWP_UINT32 |
| The reason for reauthorizing a previously authorized connection. Data type:FWP_UINT32 |
| The reason for reauthorizing a previously authorized connection, such asFWP_CONDITION_REAUTHORIZE_REASON_POLICY_CHANGE(or one of the other values listed inFilter health indicators). Data type:FWP_UINT32 |
| The ICMP type with which the flow was created. Data type:FWP_UINT16 |
| The LUID of the physical interface associated with the incoming IP address. Data type:FWP_UINT64 |
| The LUID of the next-hop physical interface. Data type:FWP_UINT64 |
| The epoch count associated with an interface. Reserved. Data type:FWP_UINT64 |
| Reserved for internal use. Data type:FWP_UINT32 |
Constants available for Windows Vista with SP1, Windows Server 2008 and later versions | Description |
---|---|
| The LUID for the network interface associated with the incoming IP address. Data type:FWP_UINT64 |
| The type of incoming network interface as defined by the Internet Assigned Names Authority (IANA). For more information, seehttps://www.iana.org/assignments/ianaiftype-mib. Possible values:The interface type values listed in the Ipifcons.h header file. Data type:FWP_UINT32 |
| The tunneling method used by a tunnel bound to the incoming network interface when the Type member is IF_TYPE_TUNNEL. The tunnel type is defined by the Internet Assigned Names Authority (IANA). For more information, seehttps://www.iana.org/assignments/ianaiftype-mib. Possible values:Values for the TUNNEL_TYPE enumeration type are listed in the Ifdef.h header file. Data type:FWP_UINT32 |
| The index of the incoming network interface as listed by the network stack. Data type:FWP_UINT32 |
| The index of the incoming network interface as listed by the network stack. Data type:FWP_UINT32 |
| The index of the network interface as listed by the network stack. Data type:FWP_UINT32 |
| The type of interface defined by the Internet Assigned Names Authority (IANA). For more information, seehttps://www.iana.org/assignments/ianaiftype-mib. Possible values:The interface type values listed in the Ipifcons.h header file. Data type:FWP_UINT32 |
| The tunneling method used by a tunnel when the Type member is IF_TYPE_TUNNEL. The tunnel type is defined by the Internet Assigned Names Authority (IANA). For more information, seehttps://www.iana.org/assignments/ianaiftype-mib. Possible values:Values for the TUNNEL_TYPE enumeration type are listed in the Ifdef.h header file. Data type:FWP_UINT32 |
Constants available for Windows Vista and higher | Description |
---|---|
| Local IP addresses. Data type:To an IPv4 address
Data type:To an IPv6 address
|
| The remote IP address. Data type:To an IPv4 address
Data type:To an IPv6 address
|
| The source IP address for forwarded packets. Data type:To an IPv4 address
Data type:To an IPv6 address
|
| The destination IP address for forwarded packets. Data type:To an IPv4 address
Data type:To an IPv6 address
|
| The local IP address type. Possible values:one of the followingNL_ADDRESS_TYPEenumeration values.
Data type:FWP_UINT8 |
| The destination IP address type for forwarded packets. Possible values:one of the followingNL_ADDRESS_TYPEenumeration values.
Data type:FWP_UINT8 |
| The LUID for the network interface associated with the local IP address. Data type:FWP_UINT64 |
| The type of interface defined by the Internet Assigned Names Authority (IANA). For more information, seehttps://www.iana.org/assignments/ianaiftype-mib. Possible values:The interface type values listed in the Ipifcons.h header file. Data type:FWP_UINT32 |
| The tunneling method used by a tunnel when the Type member is IF_TYPE_TUNNEL. The tunnel type is defined by the Internet Assigned Names Authority (IANA). For more information, seehttps://www.iana.org/assignments/ianaiftype-mib. Possible values:Values for the TUNNEL_TYPE enumeration type are listed in the Ifdef.h header file. Data type:FWP_UINT32 |
| The LUID of the network interface to which the forwarded packet will be sent. Data type:FWP_UINT64 |
| The IP protocol number as specified in RFC 1700. Data type:FWP_UINT8 |
| The local transport protocol port number. Data type:FWP_UINT16 |
| The ICMP type field as specified in RFC 792. Data type:FWP_UINT16 |
| The port number of the long distance transport protocol. Data type:FWP_UINT16 |
| The ICMP code field as specified in RFC 792. Data type:FWP_UINT16 |
| The type of local IP address embedded in the ICMP packet. Possible values:one of the followingNL_ADDRESS_TYPEenumeration values.
Data type:FWP_UINT8 |
| The remote IP address embedded in the ICMP packet. Data type:To an IPv4 address
Data type:To an IPv6 address
|
| The IP protocol number embedded in the ICMP packet as specified in RFC 1700. Data type:FWP_UINT8 |
| The local transport protocol port number embedded in the ICMP packet. Data type:FWP_UINT16 |
| The remote transport protocol port number embedded in the ICMP packet. Data type:FWP_UINT16 |
| A bitwise OR of a combination of filter condition flags. Possible values:verFilter health indicators Data type:FWP_UINT32 |
| The direction of traffic or data flow. Possible values:
For datagram skins (FWPM_LAYER_DATAGRAM_DATA_) and stream packet layers (FWPM_LAYER_STREAM_PACKET_), the value is the same as the packet address. For stream layers (FWPM_LAYER_STREAM_) and established flow layers (FWPM_LAYER_ALE_FLOW_ESTABLISHED_), the value corresponds to the address of the connection. (For example, if a local application initiates the connection, an incoming packetFWPM_CONDITION_DIRECTIONadapted toFWP_DIRECTION_OUTBOUND.) Data type:FWP_UINT32 |
| The index of the network interface as listed by the network stack. Data type:FWP_UINT32 |
| The index of the logical network interface as listed by the network stack. Data type:FWP_UINT32 |
| The source network interface index for forwarded packets as enumerated by the network stack. Data type:FWP_UINT32 |
| The source logical network interface index for forwarded packets as enumerated by the network stack. Data type:FWP_UINT32 |
| The destination network interface index for forwarded packets as listed by the network stack. Data type:FWP_UINT32 |
| The destination logical network interface index for forwarded packets, as listed by the network stack. Data type:FWP_UINT32 |
| The full device path of the app, as returned byFwpmGetAppIdFromFileName0Occupation. (Por exemplo "\device0\hardiskvolume1\Program Files\Application.exe".) Data type:FWP_BYTE_BLOB_TYPE |
| The local user ID. Data type:FWP_SECURITY_DESCRIPTOR_TYPE |
| The remote user ID. Data type:FWP_SECURITY_DESCRIPTOR_TYPE |
| The identification of the remote computer. Data type:FWP_SECURITY_DESCRIPTOR_TYPE |
| The raw socket mode allowed or denied. Possible values:
Data type:FWP_UINT32 |
| Reserved for internal use. Data type:FWP_UINT32 |
| Reserved for internal use. Data type:FWP_UINT32 |
The following constants are available for user mode only.
User mode conditions available for Windows 8 and Windows Server 2012 | Description |
---|---|
| The Quick Mode (QM) filter mode. what concernsIPSEC_TRAFFIC_TYPEfor possible values. Data type:FWP_UINT32 |
User mode conditions available for Windows 7, Windows Server 2008 R2 and later versions | Description |
---|---|
| Reserved for internal use. Data type:FWP_UINT32 |
| The partner's name. For example, the DNS name of the peer. Data type:FWP_BYTE_BLOB_TYPE |
| The identity of the remote authentication principal. Data type:FWP_SECURITY_DESCRIPTOR_TYPE |
| The type of authentication method IKE, IKEv2, or AuthIP. Data type:IKEEXT_AUTHENTICATION_METHOD_TYPE |
| The type of encoding mechanism. Data type:IKEEXT_KEY_MODULE_TYPE |
| The IPsec mode in which a token can be obtained. Data type:IPSEC_TOKEN_MODE |
| The policy provider context key for the main mode (MM) or quick mode (QM) of the authorized SA. Useful for restricting the scope of the authorization rule to SAs formed by a specified IPsec MM or QM policy key. Data type:FWP_BYTE_ARRAY16_TYPE |
| The method used to authenticate the security association.[!Use] Data type:FWP_UINT32 |
Constants available for Windows Vista and higher | Description |
---|---|
| The remote user ID. Data type:FWP_SECURITY_DESCRIPTOR_TYPE |
| O UUID da interface RPC. Data type:FWP_BYTE_ARRAY16_TYPE |
| The version of the RPC interface. Data type:FWP_UINT16 |
| Reserved for internal use. Data type:FWP_UINT32 |
| The ID of the COM application. Data type:FWP_BYTE_ARRAY16_TYPE |
| The name of the application. Data type:FWP_BYTE_BLOB_TYPE |
| The RPC protocol. Possible values:
Data type:FWP_UINT8 |
| The type of authentication service. For more information about the types of authentication services, seeauthentication service constants. Data type:FWP_UINT8 |
| The authentication service level. For more information about authentication service levels, seeAuthentication Level Constants. Data type:FWP_UINT8 |
| The certificate-based Security Service Provider Interface (SSPI) encryption algorithm. Data type:FWP_UINT32 |
| The size of the SSPI encryption key based on the certificate. Data type:FWP_UINT32 |
| The local IPv4 address. Data type:
|
| The local IPv6 address. Data type:
|
| The remote IPv4 address. Data type:
|
| The remote IPv6 address. Data type:
|
| The name of the remote named pipe. Data type:FWP_BYTE_BLOB_TYPE |
| The UUID of the process using the RPC interface. Data type:FWP_BYTE_ARRAY16_TYPE |
| Reserved for internal use. Data type:FWP_BYTE_BLOB_TYPE |
| Reserved for internal use. Data type:FWP_UINT32 |
| The client ID when using RpcProxy. Data type:FWP_SECURITY_DESCRIPTOR_TYPE |
| The RPC server name when using RpcProxy. Data type:FWP_BYTE_BLOB_TYPE |
| The port on the RPC server when using RpcProxy. Data type:FWP_UINT16 |
| The type of RPC proxy authentication service. Data type:FWP_BYTE_BLOB_TYPE |
| The length of the Secure Sockets Layer (SSL) key in the client certificate. Data type:FWP_UINT32 |
| The object identifier in the client certificate. Data type:FWP_BYTE_BLOB_TYPE |
| The liquid event type. Data type:FWP_UINT32 |
comments
When IP addresses are stored in FWP_UINT32 format or when an IP port is stored in FWP_UINT16 format, they are stored in host order, not network order.
requirements
application | bravura |
---|---|
Minimum client supported | Windows Vista [nur Desktop-Apps] |
minimum server allowed | Windows Server 2008 [desktop apps only] |
Header |
|