original requestor for n/w io

in the case of Io coming through teh srv, like real SMB share IO requests,
or perhaps the localhost being redirected through smb (\localhost\C$) the
create request to open a file comes to the minifilter as a kernel request
from SRV. Is there a way to find who the original requwestor was (assuming
it is a local use trying to use \127.0.0.1\c$ or \localhost\c$ to open
the c driver instead of a regular createFile?

Check the SRV_OPEN_ECP_CONTEXT and see if that works for you:

https://msdn.microsoft.com/en-us/library/windows/hardware/ff556749(v=vs.85).aspx

-scott
OSR
@OSRDrivers