How to distinguish IRPs of MJ_CREATE to RDR or local NTFS volume?

NTFSD
1

Hello,

If a filter driver wants to filter both local access and remote access
(IRP_MJ_CREATE requests only), is there some flag to be used to identify the
difference? Should I only parse the file name in a file object to resolves
this?

Any information is appreciated,

Shangwu

2

Let me ask another question. If my filter attaches to different file
systems, is it necessary to set a flag in my device object for each target
device object to identify the type of file system?

Thanks,
Shangwu

“Shangwu” wrote in message news:xxxxx@ntfsd…
> Hello,
>
> If a filter driver wants to filter both local access and remote access
> (IRP_MJ_CREATE requests only), is there some flag to be used to identify
> the difference? Should I only parse the file name in a file object to
> resolves this?
>
> Any information is appreciated,
>
> Shangwu
>
>
>