在标注注册之前建立的流量包是什么？ [英] What ablout the packets of flows which were established before callout registered?

问题描述

在我的标注dirver whitch在ALE和STREAM层工作。有时，在FWPS_LAYER_ALE_AUTH_CONNECT_V4层工作的classfiyFn函数会针对相同的流ID和相同的流程信息重复调用。附加调试器后，我发现
所有数据包都属于单个TCP链接。链接是在我的驱动程序加载之前建立的，它是通过在另一个驱动程序中调用TDI_CONNECT请求创建的。

In my callout dirver whitch work at ALE and STREAM layers. Sometimes my classfiyFn function which work at FWPS_LAYER_ALE_AUTH_CONNECT_V4 layer gets called repeatly for the same flow ID and same process information. After attach debugger, I found that all the packets are belong to a single TCP link. The link is established before my dirver was loaded, and it was created by calling TDI_CONNECT request in another driver.

这是正常的吗？所有的流包都是在callout注册之前创建的case case对应的classfiyFn函数被重复调用吗？

Is it normal? All the packets of flows were created before callout registered will case corresponding classfiyFn function get called repeatly?

推荐答案

在ALE_AUTH_CONNECT添加过滤器时，连接将重新授权。只要ALE层发生过滤器更改，就会发生这种情况。

When you add your filter at ALE_AUTH_CONNECT, the connection will reauthorize. This happens anytime there is a filter change at the ALE layers.

希望这会有所帮助，

这篇关于在标注注册之前建立的流量包是什么？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！