Sorry if this is a noob question, but could somebody please tell me how to set up a basic, low level packet filter?

Nothing fancy

I'm just looking for something like, a win32 function I call and the argument I give it is the address in my code and then when a packet is being sent in or out, the packet is sent here, along with it's length and whether it's going in or out, and then another function I call to let it go through or not? Or better yet just one to manually send it myself so it can be modified if necessary?

In short: I don't need to OS to handle any of the complicated high level stuff. I want to just want to completely do that all in my own program.


If anyone knows what functions I need for this low level functionality please tell me because I can't find it anywhere.



P.S. sorry if this is a really easy (and/or poorly worded) question, I'm rather new to fasm and the win32 API..


edit:
LOL I searched for my oldest post (out of curiosity) and the first sentence had a typo. Fixed!

You need to either write your own driver or install an existing driver. Do a search for "pcap". I think it does what you need.

Thanks, I'll take a look at it. Just to make sure we're on the same page first though, this will let me choose whether or not the packets are allowed through (not just look at them) right?

Oh, for that I am not sure about.

If pcap is not suitable, then another option is to use a local socks proxy. With a proxy you can have complete control over what is sent and received. But it requires you to set each app with the proxy settings and not all apps can support using a socks interface.

It sounds like it wouldn't be low level enough to prevent programs from getting around it if they really want to.. and I don't think that will be able to stop other types of traffic like ICMP..

I'm sure there's a way though, because that's how all firewalls work right?
Or did I just read your post wrong?


I just want to route all data that is going to be sent in through or out of the ethernet port to be routed through this and have it decide whether or not to allow it through

Okay, if you are requiring it in such a way that programs are not aware what is happening then you definitely need to be at the driver level. Perhaps there is an open-source firewall that has a driver in it you can examine.

Okay thanks I'll keep looking