WINDIVERT_LAYER_NETWORK_FORWARD pAddr->Outbound = 1 all the time

[kalirenegade-dev]

when using WINDIVERT_LAYER_NETWORK_FORWARD all packets have the same direction pAddr->Outbound

example using ics to share your internet with other devices you would use WINDIVERT_LAYER_NETWORK_FORWARD to capture and redirect the packets however when you check the direction of the packet with pAddr->Outbound you would expect there to be outbound and inbound however they are all outbound when using WINDIVERT_LAYER_NETWORK this works like it should showing outbound and inbound

[kalirenegade-dev]

so i have to read each packet and compare the ip address to the local network ip to identify the inbound now? i feel like this would slow down the traffic relay

[merlinz01]

i have to read each packet and compare the ip address to the local network ip to identify the inbound

That is correct. As I understand it, the NETWORK_FORWARD layer captures packets in the middle of traveling through the local machine, so there is not a meaningful inbound vs. outbound concept.