Hi,
I’m interested in monitoring incoming SMB connections. To my knowledge
there is limited way to do it from user mode (eg. polling basic APIs that
give limited information). Any suggestions how to do it from kernel mode?
There are several drivers responsible for SMB communication, so probably I
should filter some of them. But which ones, and how? Please let me know how
to start with this.