Metadata Fields at Each Filtering Layer

The following table lists the possible metadata fields that are available by layer. Some fields are available only under specific circumstances. For example, the metadata field FWPS_METADATA_FIELD_FRAGMENT_DATA is available for inbound IP packet layers only if the packet is fragmented. Layers that are not listed in the table do not have any available metadata fields.

Run-time filtering layer identifier Metadata fields

FWPS_LAYER_INBOUND_IPPACKET_V4

FWPS_LAYER_INBOUND_IPPACKET_V6

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_FRAGMENT_DATA

FWPS_LAYER_INBOUND_IPPACKET_V4_DISCARD

FWPS_LAYER_INBOUND_IPPACKET_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_FRAGMENT_DATA

FWPS_LAYER_OUTBOUND_IPPACKET_V4

FWPS_LAYER_OUTBOUND_IPPACKET_V6

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_FRAGMENT_DATA

FWPS_METADATA_FIELD_PATH_MTU

FWPS_LAYER_OUTBOUND_IPPACKET_V4_DISCARD

FWPS_LAYER_OUTBOUND_IPPACKET_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_FRAGMENT_DATA

FWPS_METADATA_FIELD_PATH_MTU

FWPS_LAYER_IPFORWARD_V4

FWPS_LAYER_IPFORWARD_V6

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_LAYER_IPFORWARD_V4_DISCARD

FWPS_LAYER_IPFORWARD_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_LAYER_INBOUND_TRANSPORT_V4

FWPS_LAYER_INBOUND_TRANSPORT_V6

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ALE_CLASSIFY_REQUIRED

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_LAYER_INBOUND_TRANSPORT_V4_DISCARD

FWPS_LAYER_INBOUND_TRANSPORT_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ALE_CLASSIFY_REQUIRED

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_LAYER_OUTBOUND_TRANSPORT_V4

FWPS_LAYER_OUTBOUND_TRANSPORT_V6

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD

FWPS_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_LAYER_STREAM_V4

FWPS_LAYER_STREAM_V6

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_LAYER_STREAM_V4_DISCARD

FWPS_LAYER_STREAM_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_LAYER_DATAGRAM_DATA_V4

FWPS_LAYER_DATAGRAM_DATA_V6

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_LAYER_DATAGRAM_DATA_V4_DISCARD

FWPS_LAYER_DATAGRAM_DATA_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_LAYER_INBOUND_ICMP_ERROR_V4

FWPS_LAYER_INBOUND_ICMP_ERROR_V6

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD

FWPS_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4

FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD

FWPS_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4

FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_COMPLETION_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD

FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_COMPLETION_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_AUTH_LISTEN_V4

FWPS_LAYER_ALE_AUTH_LISTEN_V6

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_COMPLETION_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_AUTH_LISTEN_V4_DISCARD

FWPS_LAYER_ALE_AUTH_LISTEN_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_COMPLETION_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4

FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_COMPLETION_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_PACKET_DIRECTION

FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD

FWPS_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_COMPLETION_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_PACKET_DIRECTION

FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_AUTH_CONNECT_V4

FWPS_LAYER_ALE_AUTH_CONNECT_V6

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_COMPLETION_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_METADATA_FIELD_PACKET_DIRECTION

FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_AUTH_CONNECT_V4_DISCARD

FWPS_LAYER_ALE_AUTH_CONNECT_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_COMPLETION_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_METADATA_FIELD_PACKET_DIRECTION

FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4

FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD

FWPS_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD

FWPS_METADATA_FIELD_DISCARD_REASON

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_PROCESS_PATH

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_RESERVED

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_INBOUND_MAC_FRAME_802_3

FWPS_METADATA_FIELD_ETHER_FRAME_LENGTH

FWPS_LAYER_ALE_RESOURCE_RELEASE_V4

FWPS_LAYER_ALE_RESOURCE_RELEASE_V6

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V4

FWPS_LAYER_ALE_ENDPOINT_CLOSURE_V6

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_CONNECT_REDIRECT_V4

FWPS_LAYER_ALE_CONNECT_REDIRECT_V6

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_PARENT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_ICMP_ID_AND_SEQUENCE

FWPS_METADATA_FIELD_LOCAL_REDIRECT_TARGET_PID

FWPS_METADATA_FIELD_REDIRECT_RECORD_HANDLE

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_ALE_BIND_REDIRECT_V4

FWPS_LAYER_ALE_BIND_REDIRECT_V6

FWPS_METADATA_FIELD_TOKEN

FWPS_METADATA_FIELD_PROCESS_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_LOCAL_REDIRECT_TARGET_PID

FWPS_METADATA_FIELD_SUB_PROCESS_TAG

FWPS_LAYER_STREAM_PACKET_V4

FWPS_LAYER_STREAM_PACKET_V6

FWPS_METADATA_FIELD_FLOW_HANDLE

FWPS_METADATA_FIELD_IP_HEADER_SIZE

FWPS_METADATA_FIELD_SYSTEM_FLAGS

FWPS_METADATA_FIELD_TRANSPORT_HEADER_SIZE

FWPS_METADATA_FIELD_COMPARTMENT_ID

FWPS_METADATA_FIELD_TRANSPORT_ENDPOINT_HANDLE

FWPS_METADATA_FIELD_TRANSPORT_CONTROL_DATA

FWPS_METADATA_FIELD_REMOTE_SCOPE_ID

FWPS_LAYER_INGRESS_VSWITCH_ETHERNET

FWPS_LAYER_EGRESS_VSWITCH_ETHERNET

FWPS_L2_METADATA_FIELD_ETHERNET_MAC_HEADER_SIZE

FWPS_L2_METADATA_FIELD_WIFI_OPERATION_MODE

FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_PORT_ID

FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_NIC_INDEX

FWPS_L2_METADATA_FIELD_VSWITCH_PACKET_CONTEXT

FWPS_L2_METADATA_FIELD_VSWITCH_DESTINATION_PORT_ID

FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V4

FWPS_LAYER_INGRESS_VSWITCH_TRANSPORT_V6

FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V4

FWPS_LAYER_EGRESS_VSWITCH_TRANSPORT_V6

FWPS_L2_METADATA_FIELD_WIFI_OPERATION_MODE

FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_PORT_ID

FWPS_L2_METADATA_FIELD_VSWITCH_SOURCE_NIC_INDEX

FWPS_L2_METADATA_FIELD_VSWITCH_PACKET_CONTEXT

FWPS_L2_METADATA_FIELD_VSWITCH_DESTINATION_PORT_ID

 

 

 

Send comments about this topic to Microsoft

Show: