I am trying to detect port scanning attempts on a system for which I am capturing and analyzing incoming SYN packets(SYN packets received for non-listening ports too) at IPV4 and IPV4_DISCARD layers in WFP and have been successful to do so. But for windows 7, I am trying to achieve the same using TDI driver and have checked with TDI_EVENT_CONNECT and TDI_EVENT_ERROR events, but have not been successful.
Is there a way in TDI or some other framework in windows 7 to capture SYN requests (also discarded)