I am developing a driver which updates the local IP address with specific IP addresses, I have used the “FWPM_LAYER_ALE_BIND_REDIRECT_V4” to capture the packets.
When I start the local server it is captured as process id “4” which is a “system” process running in WTS ID “0”.
I need the original process ID(HTTP server which is started) so that I can identify the process name and WTS correctly and update the source IP address of it.