從Windows 2000開始IpFilterDriver是系統(tǒng)自帶的一個(gè)驅(qū)動(dòng),顧名思義,就是IP過濾
驅(qū)動(dòng),對應(yīng)ipfltdrv.sys文件。缺省情況下,這個(gè)驅(qū)動(dòng)并未加載,但可以手工加載。
啟動(dòng)控制臺(tái)
> sc queryex IpFilterDriver
SERVICE_NAME: IpFilterDriver
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :
> enumservice.exe | findstr /I ipfilter
設(shè)備驅(qū)動(dòng)程序 停止 IpFilterDriver IP Traffic Filter Driver
> net start IpFilterDriver
The IP Traffic Filter Driver service was started successfully.
> enumservice.exe | findstr /I ipfilter
設(shè)備驅(qū)動(dòng)程序 運(yùn)行 IpFilterDriver IP Traffic Filter Driver
> net stop IpFilterDriver
The IP Traffic Filter Driver service was stopped successfully.
Filter-Hook Driver是一種KMD,與IpFilterDriver相配合。顯然這只能用于TCP/IP
協(xié)議,而對IPX/SPX、NetBEUI等其它協(xié)議無能為力。
最多只能安裝一個(gè)Filter-Hook Driver。僅當(dāng)filter-hook callback function為空
時(shí),F(xiàn)ilter-Hook Driver才能向IpFilterDriver注冊自己所提供的回調(diào)函數(shù),后者調(diào)
用filter-hook callback function以決定如何處理接收到的或者即將發(fā)送的IP報(bào)文。
注冊回調(diào)函數(shù)結(jié)束之后,IpFilterDriver將Filter-Hook Driver相應(yīng)的文件對象與回
調(diào)函數(shù)關(guān)聯(lián)起來,以此確保只有一個(gè)Filter-Hook Driver可用。
聯(lián)系客服