Implementing a Custom WFP Callout Driver with Optimized Packet Handling

NTDEV
1

Hello everyone,

I’m currently developing a Windows kernel driver that leverages Windows Filtering Platform (WFP) callouts to inspect and manage network traffic. The driver is built using the latest WDK and Visual Studio toolchain, and registration at the appropriate layers is working as expected.

As part of ongoing optimization, I’m experimenting with enhanced work-queue handling to keep packet processing efficient under sustained throughput. In one test setup, the system is connected to storage and networking hardware that uses FC fiber, and I’m interested in ensuring that my queuing and context management align well with high-speed data paths.

I’d appreciate any guidance from the community on best practices for managing per-flow contexts, CPU affinity considerations, or recommended patterns for scaling WFP callouts across multiple cores. If needed, I can share trace data or simplified code samples.

Thanks for your time and insights.

2

That is not a small topic. And not one that is easily covered on a forum like this unless you have a more specific question.

A lot depends of course on what kind of work you need to do in your filter. And how easy it is to split that work into groups or chunks that don’t depend on one another. more details are needed to say anything more meaningful