How to use "FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 " to capture packets.

NTDEV
1

I have written a driver to filter calls based on the FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 but found that calls are not detected.
I have used the following conditions for packet filtration.

FWPM_FILTER filter = { 0 };
FWPM_FILTER_CONDITION filterConditions[2] = { 0 };
const UINT conditionIndex = 2;

filter.layerKey = *layerKey;
filter.displayData.name = (wchar_t*)filterName;
filter.displayData.description = (wchar_t*)filterDesc;

filter.action.type = FWP_ACTION_CALLOUT_INSPECTION;
filter.action.calloutKey = *calloutKey;
filter.filterCondition = filterConditions;
filter.subLayerKey = TL_INSPECT_SUBLAYER;
filter.weight.type = FWP_EMPTY; // auto-weight.
filter.rawContext = context;
filterConditions[0].fieldKey = FWPM_CONDITION_IP_PROTOCOL;
filterConditions[0].matchType = FWP_MATCH_EQUAL;
filterConditions[0].conditionValue.type = FWP_UINT8;
filterConditions[0].conditionValue.uint8 = IPPROTO_UDP;

filterConditions[1].fieldKey = FWPM_CONDITION_IP_PROTOCOL;
filterConditions[1].matchType = FWP_MATCH_EQUAL;
filterConditions[1].conditionValue.type = FWP_UINT8;
filterConditions[1].conditionValue.uint8 = IPPROTO_TCP;

filter.numFilterConditions = conditionIndex;

Could you please let me know how I can correctly define the filter condition to capture the packets.

2

This filtering layer allows for authorizing transport port assignments, bind requests, promiscuous mode requests, and raw mode requests.

I would start by reading the docs.