UDP and ICMP payload size at FWPM_LAYER_DATAGRAM_DATA

NTDEV
1

How to determine the size of data without size of the packet transport header?
I encountered some unobvious behavior:

  1. For outbound ICMP packet, pInMetaValues->transportHeaderSize is 8 and dataLength=NET_BUFFER_DATA_LENGTH(NET_BUFFER_LIST_FIRST_NB(netBufferList))) includes both transport header size and data size (32+8=40 for default ping.exe request)
  2. For inbound ICMP packet, pInMetaValues->transportHeaderSize is 0 but dataLength is also 40 (includes transport header size)
  3. For outbound UDP packet, pInMetaValues->transportHeaderSize is 8, and dataLength includes transport header size
  4. For inbound UDP packet, pInMetaValues->transportHeaderSize is 8, and dataLength doesn't include transport header size

Is this a WFP bug?
How to determine the real data size of a packet?

2

You're probably seeing this because the offset into the packet is different depending on the direction of the packet: Data offset positions - Windows drivers | Microsoft Learn