Windows Filtering Platform

<h2 id="components">Components</h2>
<p>The filtering platform includes the following components:
</p>
<ul><li><a href="/facts/Shim_(computing)/LRz0gdKm">Shims</a>, which expose the internal structure of a <a href="/facts/Packet_(information_technology)/xCYf8SJu">packet</a> as properties. Different shims exist for <a href="/facts/Communications_protocol/5uady7cB">protocols</a> at different <a href="/facts/TCP%2fIP_model/KNkxtSpw">layers</a>. WFP comes with a set of shims; users can register shims for other protocols using the API. The in-built set of shims includes:
<ul><li>Application Layer Enforcement (ALE) shim</li>
<li><a href="/facts/Transport_layer/UmIGUCeK">Transport Layer</a> Module (TLM) shim</li>
<li><a href="/facts/Network_layer/L2jAtJzQ">Network Layer</a> Module (NLM) shim</li>
<li><a href="/facts/Remote_Procedure_Call/uMMb9CQw">RPC</a> Runtime shim</li>
<li><a href="/facts/Internet_Control_Message_Protocol/VnrV56J0">Internet Control Message Protocol</a> (ICMP) shim</li>
<li>Stream shim</li></ul></li></ul>
<ul><li>Filtering engine, which spans both <a href="/facts/Kernel-mode/27y4kjHs">kernel-mode</a> and <a href="/facts/User-mode/27y4kjHs">user-mode</a>, providing basic filtering capabilities. It matches the data within a packet – as exposed by the shims – against filtering rules, and either blocks or permits the packet. A <i>callout</i> (see below) may implement any other action as required. The filters operate on a per-application basis. To mitigate conflicts between filters, they are given <i>weights</i> (priorities) and grouped into <i>sublayers</i>, which also have weights. Filters and callouts may be associated to <i>providers</i> which may be given a name and description and are essentially associated to a particular application or service.</li>
<li>Base filtering engine, the module that manages the filtering engine. It accepts filtering rules and enforces the security model of the application. It also maintains statistics for the WFP and logs its state.</li>
<li>Callout, a <a href="/facts/Callback_(computer_science)/vPlrCJXG">callback</a> function exposed by a filtering driver. The filtering drivers provide filtering capabilities other than the default block/allow. Administrators specify a callout function during registration of a filter rule. When the filter matches, the system invokes the callout, which handles a specified action.</li></ul>
<h2 id="diagnostics">Diagnostics</h2>
<p>Starting with <a href="/facts/Windows_7/tldLdbnX">Windows 7</a>, the <a href="/facts/Netsh/UwWf9lbj">netsh</a> command can diagnose of the internal state of WFP.
</p>
<h2 id="hotfix">Hotfix</h2>
<p>Microsoft released three out-of-band hotfixes for WFP in Windows Vista and Windows 7 to address issues that could cause a memory leak, loss of connectivity during a <a href="/facts/Remote_Desktop_Connection/4b05uM5B">Remote Desktop Connection</a> session, or a <a href="/facts/Blue_screen_of_death/f7LFeRBa">blue screen of death</a>. Later, these hotfixes were rolled up into one package.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a>
</p>

<ul><li>Kresten, Proteus Valre (May 2012). <a href="https://dl.acm.org/doi/abs/10.5555/2463137"><i>Windows Filtering Platform</i></a>. VolutPress. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 978-620-1-65842-4. Retrieved 25 March 2025.</li></ul>
<h2 id="external-links">External links</h2>
<ul><li><a href="https://docs.microsoft.com/en-us/windows-hardware/drivers/network/windows-filtering-platform-architecture-overview">Windows Filtering Platform Architecture Overview</a></li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"A Windows Filtering Platform (WFP) driver hotfix rollup package is available for Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2". Windows support. Microsoft. 12 April 2010. <a href="https://support.microsoft.com/en-us/help/981889/a-windows-filtering-platform-wfp-driver-hotfix-rollup-package-is-avail" target="_blank">https://support.microsoft.com/en-us/help/981889/a-windows-filtering-platform-wfp-driver-hotfix-rollup-package-is-avail</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
</ol>

Windows Filtering Platform open-in-new

Windows Filtering Platform