WinDivert layer parameter

Question

The layer of the WinDivert handle is determined by the layer parameter. Currently the following layers are supported.

DIVERT_LAYER_NETWORK :- The network layer. This is the default. DIVERT_LAYER_NETWORK_FORWARD :- The network layer (forwarded packets). what is the difference between both DIVERT_LAYER_NETWORK and DIVERT_LAYER_NETWORK_FORWARD ?

Answer 1

It is possible to configure Windows as a router and forward packets, i.e. packets that arrive on one interface are forwarded to another interface and sent on their way. Such packets are neither inbound (i.e. destined to the local machine) nor outbound (i.e. originate from the local machine). To use WinDivert to capture forwarded packets, you need to use the FORWARD layer. Otherwise for inbound/outbound traffic, you must use the non-FORWARD layer.