Per the documentation, WFP filters may be attached at any time without bringing down the interfaces. But how this actually works and what is the effect on existing TCP and UDP connections?
I'm working on a driver that contains WFP and TDI based filters. During Windows startup the filters start concurrently with user software (services and 'normal' applications). Some 3rd party user software fails to enumerate network interfaces in presence of my driver (but succeeds after a short retry). Other users report various problems. But majority of users do not see any problems.
What can be wrong? Is some synchronization missing in my driver?
Delaying attaching my filters is not desirable. This is sort of "security" filter and must apply as early as possible.