ホーム › NetworkManagement.IpHelper › PF_INTERFACE_STATS

PF_INTERFACE_STATS

構造体

サイズx64: 152 バイト / x86: 120 バイト

サイズ=各フィールドのバイト数(x64/x86 で異なる場合は x64/x86 と併記)。x64/x86 列=フィールドのバイトオフセット(HSPで dupptr / lpoke / wpoke 等に使用)。

フィールド

フィールド	型	サイズ	x64	x86	説明
pvDriverContext	void*	8/4	+0	+0	ドライバが使用するコンテキストポインタである。
dwFlags	DWORD	4	+8	+4	インタフェースのフィルタ動作を示すビットフラグである。
dwInDrops	DWORD	4	+12	+8	受信方向で破棄されたパケット数である。
dwOutDrops	DWORD	4	+16	+12	送信方向で破棄されたパケット数である。
eaInAction	PFFORWARD_ACTION	4	+20	+16	受信方向の既定アクション(PFFORWARD_ACTION、転送/破棄)である。
eaOutAction	PFFORWARD_ACTION	4	+24	+20	送信方向の既定アクション(PFFORWARD_ACTION、転送/破棄)である。
dwNumInFilters	DWORD	4	+28	+24	受信方向に設定されたフィルタ数である。
dwNumOutFilters	DWORD	4	+32	+28	送信方向に設定されたフィルタ数である。
dwFrag	DWORD	4	+36	+32	フラグメントに関するフィルタ処理回数である。
dwSpoof	DWORD	4	+40	+36	スプーフィング検出によりフィルタされた回数である。
dwReserved1	DWORD	4	+44	+40	予約済みフィールドである。
dwReserved2	DWORD	4	+48	+44	予約済みフィールドである。
liSYN	LONGLONG	8	+56	+48	フィルタされたSYNパケット数(64ビット)である。
liTotalLogged	LONGLONG	8	+64	+56	ログに記録された総パケット数(64ビット)である。
dwLostLogEntries	DWORD	4	+72	+64	バッファ不足などで失われたログエントリ数である。
FilterInfo	PF_FILTER_STATS	72/48	+80	+68	代表的なフィルタ統計(PF_FILTER_STATS)である。

各言語での定義

#include <windows.h>

// PF_FILTER_DESCRIPTOR  (x64 64 / x86 44 バイト)
typedef struct PF_FILTER_DESCRIPTOR {
    DWORD dwFilterFlags;
    DWORD dwRule;
    PFADDRESSTYPE pfatType;
    BYTE* SrcAddr;
    BYTE* SrcMask;
    BYTE* DstAddr;
    BYTE* DstMask;
    DWORD dwProtocol;
    DWORD fLateBound;
    WORD wSrcPort;
    WORD wDstPort;
    WORD wSrcPortHighRange;
    WORD wDstPortHighRange;
} PF_FILTER_DESCRIPTOR;

// PF_FILTER_STATS  (x64 72 / x86 48 バイト)
typedef struct PF_FILTER_STATS {
    DWORD dwNumPacketsFiltered;
    PF_FILTER_DESCRIPTOR info;
} PF_FILTER_STATS;

// PF_INTERFACE_STATS  (x64 152 / x86 120 バイト)
typedef struct PF_INTERFACE_STATS {
    void* pvDriverContext;
    DWORD dwFlags;
    DWORD dwInDrops;
    DWORD dwOutDrops;
    PFFORWARD_ACTION eaInAction;
    PFFORWARD_ACTION eaOutAction;
    DWORD dwNumInFilters;
    DWORD dwNumOutFilters;
    DWORD dwFrag;
    DWORD dwSpoof;
    DWORD dwReserved1;
    DWORD dwReserved2;
    LONGLONG liSYN;
    LONGLONG liTotalLogged;
    DWORD dwLostLogEntries;
    PF_FILTER_STATS FilterInfo[1];
} PF_INTERFACE_STATS;

using System;
using System.Runtime.InteropServices;

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PF_FILTER_DESCRIPTOR
{
    public uint dwFilterFlags;
    public uint dwRule;
    public int pfatType;
    public IntPtr SrcAddr;
    public IntPtr SrcMask;
    public IntPtr DstAddr;
    public IntPtr DstMask;
    public uint dwProtocol;
    public uint fLateBound;
    public ushort wSrcPort;
    public ushort wDstPort;
    public ushort wSrcPortHighRange;
    public ushort wDstPortHighRange;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PF_FILTER_STATS
{
    public uint dwNumPacketsFiltered;
    public PF_FILTER_DESCRIPTOR info;
}

[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
public struct PF_INTERFACE_STATS
{
    public IntPtr pvDriverContext;
    public uint dwFlags;
    public uint dwInDrops;
    public uint dwOutDrops;
    public int eaInAction;
    public int eaOutAction;
    public uint dwNumInFilters;
    public uint dwNumOutFilters;
    public uint dwFrag;
    public uint dwSpoof;
    public uint dwReserved1;
    public uint dwReserved2;
    public long liSYN;
    public long liTotalLogged;
    public uint dwLostLogEntries;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 1)] public PF_FILTER_STATS[] FilterInfo;
}

Imports System.Runtime.InteropServices

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PF_FILTER_DESCRIPTOR
    Public dwFilterFlags As UInteger
    Public dwRule As UInteger
    Public pfatType As Integer
    Public SrcAddr As IntPtr
    Public SrcMask As IntPtr
    Public DstAddr As IntPtr
    Public DstMask As IntPtr
    Public dwProtocol As UInteger
    Public fLateBound As UInteger
    Public wSrcPort As UShort
    Public wDstPort As UShort
    Public wSrcPortHighRange As UShort
    Public wDstPortHighRange As UShort
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PF_FILTER_STATS
    Public dwNumPacketsFiltered As UInteger
    Public info As PF_FILTER_DESCRIPTOR
End Structure

<StructLayout(LayoutKind.Sequential, CharSet:=CharSet.Unicode)>
Public Structure PF_INTERFACE_STATS
    Public pvDriverContext As IntPtr
    Public dwFlags As UInteger
    Public dwInDrops As UInteger
    Public dwOutDrops As UInteger
    Public eaInAction As Integer
    Public eaOutAction As Integer
    Public dwNumInFilters As UInteger
    Public dwNumOutFilters As UInteger
    Public dwFrag As UInteger
    Public dwSpoof As UInteger
    Public dwReserved1 As UInteger
    Public dwReserved2 As UInteger
    Public liSYN As Long
    Public liTotalLogged As Long
    Public dwLostLogEntries As UInteger
    <MarshalAs(UnmanagedType.ByValArray, SizeConst:=1)> Public FilterInfo() As PF_FILTER_STATS
End Structure

import ctypes
from ctypes import wintypes

class PF_FILTER_DESCRIPTOR(ctypes.Structure):
    _fields_ = [
        ("dwFilterFlags", wintypes.DWORD),
        ("dwRule", wintypes.DWORD),
        ("pfatType", ctypes.c_int),
        ("SrcAddr", ctypes.c_void_p),
        ("SrcMask", ctypes.c_void_p),
        ("DstAddr", ctypes.c_void_p),
        ("DstMask", ctypes.c_void_p),
        ("dwProtocol", wintypes.DWORD),
        ("fLateBound", wintypes.DWORD),
        ("wSrcPort", ctypes.c_ushort),
        ("wDstPort", ctypes.c_ushort),
        ("wSrcPortHighRange", ctypes.c_ushort),
        ("wDstPortHighRange", ctypes.c_ushort),
    ]

class PF_FILTER_STATS(ctypes.Structure):
    _fields_ = [
        ("dwNumPacketsFiltered", wintypes.DWORD),
        ("info", PF_FILTER_DESCRIPTOR),
    ]

class PF_INTERFACE_STATS(ctypes.Structure):
    _fields_ = [
        ("pvDriverContext", ctypes.c_void_p),
        ("dwFlags", wintypes.DWORD),
        ("dwInDrops", wintypes.DWORD),
        ("dwOutDrops", wintypes.DWORD),
        ("eaInAction", ctypes.c_int),
        ("eaOutAction", ctypes.c_int),
        ("dwNumInFilters", wintypes.DWORD),
        ("dwNumOutFilters", wintypes.DWORD),
        ("dwFrag", wintypes.DWORD),
        ("dwSpoof", wintypes.DWORD),
        ("dwReserved1", wintypes.DWORD),
        ("dwReserved2", wintypes.DWORD),
        ("liSYN", ctypes.c_longlong),
        ("liTotalLogged", ctypes.c_longlong),
        ("dwLostLogEntries", wintypes.DWORD),
        ("FilterInfo", PF_FILTER_STATS * 1),
    ]

#[repr(C)]
pub struct PF_FILTER_DESCRIPTOR {
    pub dwFilterFlags: u32,
    pub dwRule: u32,
    pub pfatType: i32,
    pub SrcAddr: *mut core::ffi::c_void,
    pub SrcMask: *mut core::ffi::c_void,
    pub DstAddr: *mut core::ffi::c_void,
    pub DstMask: *mut core::ffi::c_void,
    pub dwProtocol: u32,
    pub fLateBound: u32,
    pub wSrcPort: u16,
    pub wDstPort: u16,
    pub wSrcPortHighRange: u16,
    pub wDstPortHighRange: u16,
}

#[repr(C)]
pub struct PF_FILTER_STATS {
    pub dwNumPacketsFiltered: u32,
    pub info: PF_FILTER_DESCRIPTOR,
}

#[repr(C)]
pub struct PF_INTERFACE_STATS {
    pub pvDriverContext: *mut core::ffi::c_void,
    pub dwFlags: u32,
    pub dwInDrops: u32,
    pub dwOutDrops: u32,
    pub eaInAction: i32,
    pub eaOutAction: i32,
    pub dwNumInFilters: u32,
    pub dwNumOutFilters: u32,
    pub dwFrag: u32,
    pub dwSpoof: u32,
    pub dwReserved1: u32,
    pub dwReserved2: u32,
    pub liSYN: i64,
    pub liTotalLogged: i64,
    pub dwLostLogEntries: u32,
    pub FilterInfo: [PF_FILTER_STATS; 1],
}

import "golang.org/x/sys/windows"

type PF_FILTER_DESCRIPTOR struct {
	dwFilterFlags uint32
	dwRule uint32
	pfatType int32
	SrcAddr uintptr
	SrcMask uintptr
	DstAddr uintptr
	DstMask uintptr
	dwProtocol uint32
	fLateBound uint32
	wSrcPort uint16
	wDstPort uint16
	wSrcPortHighRange uint16
	wDstPortHighRange uint16
}

type PF_FILTER_STATS struct {
	dwNumPacketsFiltered uint32
	info PF_FILTER_DESCRIPTOR
}

type PF_INTERFACE_STATS struct {
	pvDriverContext uintptr
	dwFlags uint32
	dwInDrops uint32
	dwOutDrops uint32
	eaInAction int32
	eaOutAction int32
	dwNumInFilters uint32
	dwNumOutFilters uint32
	dwFrag uint32
	dwSpoof uint32
	dwReserved1 uint32
	dwReserved2 uint32
	liSYN int64
	liTotalLogged int64
	dwLostLogEntries uint32
	FilterInfo [1]PF_FILTER_STATS
}

type
  PF_FILTER_DESCRIPTOR = record
    dwFilterFlags: DWORD;
    dwRule: DWORD;
    pfatType: Integer;
    SrcAddr: Pointer;
    SrcMask: Pointer;
    DstAddr: Pointer;
    DstMask: Pointer;
    dwProtocol: DWORD;
    fLateBound: DWORD;
    wSrcPort: Word;
    wDstPort: Word;
    wSrcPortHighRange: Word;
    wDstPortHighRange: Word;
  end;

  PF_FILTER_STATS = record
    dwNumPacketsFiltered: DWORD;
    info: PF_FILTER_DESCRIPTOR;
  end;

  PF_INTERFACE_STATS = record
    pvDriverContext: Pointer;
    dwFlags: DWORD;
    dwInDrops: DWORD;
    dwOutDrops: DWORD;
    eaInAction: Integer;
    eaOutAction: Integer;
    dwNumInFilters: DWORD;
    dwNumOutFilters: DWORD;
    dwFrag: DWORD;
    dwSpoof: DWORD;
    dwReserved1: DWORD;
    dwReserved2: DWORD;
    liSYN: Int64;
    liTotalLogged: Int64;
    dwLostLogEntries: DWORD;
    FilterInfo: array[0..0] of PF_FILTER_STATS;
  end;

const PF_FILTER_DESCRIPTOR = extern struct {
    dwFilterFlags: u32,
    dwRule: u32,
    pfatType: i32,
    SrcAddr: ?*anyopaque,
    SrcMask: ?*anyopaque,
    DstAddr: ?*anyopaque,
    DstMask: ?*anyopaque,
    dwProtocol: u32,
    fLateBound: u32,
    wSrcPort: u16,
    wDstPort: u16,
    wSrcPortHighRange: u16,
    wDstPortHighRange: u16,
};

const PF_FILTER_STATS = extern struct {
    dwNumPacketsFiltered: u32,
    info: PF_FILTER_DESCRIPTOR,
};

const PF_INTERFACE_STATS = extern struct {
    pvDriverContext: ?*anyopaque,
    dwFlags: u32,
    dwInDrops: u32,
    dwOutDrops: u32,
    eaInAction: i32,
    eaOutAction: i32,
    dwNumInFilters: u32,
    dwNumOutFilters: u32,
    dwFrag: u32,
    dwSpoof: u32,
    dwReserved1: u32,
    dwReserved2: u32,
    liSYN: i64,
    liTotalLogged: i64,
    dwLostLogEntries: u32,
    FilterInfo: [1]PF_FILTER_STATS,
};

type
  PF_FILTER_DESCRIPTOR {.bycopy.} = object
    dwFilterFlags: uint32
    dwRule: uint32
    pfatType: int32
    SrcAddr: pointer
    SrcMask: pointer
    DstAddr: pointer
    DstMask: pointer
    dwProtocol: uint32
    fLateBound: uint32
    wSrcPort: uint16
    wDstPort: uint16
    wSrcPortHighRange: uint16
    wDstPortHighRange: uint16

  PF_FILTER_STATS {.bycopy.} = object
    dwNumPacketsFiltered: uint32
    info: PF_FILTER_DESCRIPTOR

  PF_INTERFACE_STATS {.bycopy.} = object
    pvDriverContext: pointer
    dwFlags: uint32
    dwInDrops: uint32
    dwOutDrops: uint32
    eaInAction: int32
    eaOutAction: int32
    dwNumInFilters: uint32
    dwNumOutFilters: uint32
    dwFrag: uint32
    dwSpoof: uint32
    dwReserved1: uint32
    dwReserved2: uint32
    liSYN: int64
    liTotalLogged: int64
    dwLostLogEntries: uint32
    FilterInfo: array[1, PF_FILTER_STATS]

struct PF_FILTER_DESCRIPTOR
{
    uint dwFilterFlags;
    uint dwRule;
    int pfatType;
    void* SrcAddr;
    void* SrcMask;
    void* DstAddr;
    void* DstMask;
    uint dwProtocol;
    uint fLateBound;
    ushort wSrcPort;
    ushort wDstPort;
    ushort wSrcPortHighRange;
    ushort wDstPortHighRange;
}

struct PF_FILTER_STATS
{
    uint dwNumPacketsFiltered;
    PF_FILTER_DESCRIPTOR info;
}

struct PF_INTERFACE_STATS
{
    void* pvDriverContext;
    uint dwFlags;
    uint dwInDrops;
    uint dwOutDrops;
    int eaInAction;
    int eaOutAction;
    uint dwNumInFilters;
    uint dwNumOutFilters;
    uint dwFrag;
    uint dwSpoof;
    uint dwReserved1;
    uint dwReserved2;
    long liSYN;
    long liTotalLogged;
    uint dwLostLogEntries;
    PF_FILTER_STATS[1] FilterInfo;
}

HSP用定義

HSP3.7/3.8 は構造体機能が無いため4byte整数配列(dim)+peek/poke で操作(32/64bitでサイズ・位置が異なる場合はタブで分割)。IronHSP は NSTRUCT(#defstruct/stdim/->)で32/64bit共通。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x86 レイアウト)
; PF_INTERFACE_STATS サイズ: 120 バイト(x86)
dim st, 30    ; 4byte整数×30(構造体サイズ 120 / 4 切り上げ)
; pvDriverContext : void* (+0, 4byte)  st.0 = 値  /  値 = st.0   (lpoke/lpeek も可)
; dwFlags : DWORD (+4, 4byte)  st.1 = 値  /  値 = st.1   (lpoke/lpeek も可)
; dwInDrops : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; dwOutDrops : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; eaInAction : PFFORWARD_ACTION (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; eaOutAction : PFFORWARD_ACTION (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; dwNumInFilters : DWORD (+24, 4byte)  st.6 = 値  /  値 = st.6   (lpoke/lpeek も可)
; dwNumOutFilters : DWORD (+28, 4byte)  st.7 = 値  /  値 = st.7   (lpoke/lpeek も可)
; dwFrag : DWORD (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; dwSpoof : DWORD (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; dwReserved1 : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; dwReserved2 : DWORD (+44, 4byte)  st.11 = 値  /  値 = st.11   (lpoke/lpeek も可)
; liSYN : LONGLONG (+48, 8byte)  qpoke st,48,値 / qpeek(st,48)  ※IronHSPのみ。3.7/3.8は lpoke st,48,下位 : lpoke st,52,上位
; liTotalLogged : LONGLONG (+56, 8byte)  qpoke st,56,値 / qpeek(st,56)  ※IronHSPのみ。3.7/3.8は lpoke st,56,下位 : lpoke st,60,上位
; dwLostLogEntries : DWORD (+64, 4byte)  st.16 = 値  /  値 = st.16   (lpoke/lpeek も可)
; FilterInfo : PF_FILTER_STATS (+68, 48byte)  varptr(st)+68 を基点に操作(48byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; HSP3.7/3.8 は構造体機能が無いため、4byte整数の配列変数で操作します。(x64 レイアウト)
; PF_INTERFACE_STATS サイズ: 152 バイト(x64)
dim st, 38    ; 4byte整数×38(構造体サイズ 152 / 4 切り上げ)
; pvDriverContext : void* (+0, 8byte)  qpoke st,0,値 / qpeek(st,0)  ※IronHSPのみ。3.7/3.8は lpoke st,0,下位 : lpoke st,4,上位
; dwFlags : DWORD (+8, 4byte)  st.2 = 値  /  値 = st.2   (lpoke/lpeek も可)
; dwInDrops : DWORD (+12, 4byte)  st.3 = 値  /  値 = st.3   (lpoke/lpeek も可)
; dwOutDrops : DWORD (+16, 4byte)  st.4 = 値  /  値 = st.4   (lpoke/lpeek も可)
; eaInAction : PFFORWARD_ACTION (+20, 4byte)  st.5 = 値  /  値 = st.5   (lpoke/lpeek も可)
; eaOutAction : PFFORWARD_ACTION (+24, 4byte)  st.6 = 値  /  値 = st.6   (lpoke/lpeek も可)
; dwNumInFilters : DWORD (+28, 4byte)  st.7 = 値  /  値 = st.7   (lpoke/lpeek も可)
; dwNumOutFilters : DWORD (+32, 4byte)  st.8 = 値  /  値 = st.8   (lpoke/lpeek も可)
; dwFrag : DWORD (+36, 4byte)  st.9 = 値  /  値 = st.9   (lpoke/lpeek も可)
; dwSpoof : DWORD (+40, 4byte)  st.10 = 値  /  値 = st.10   (lpoke/lpeek も可)
; dwReserved1 : DWORD (+44, 4byte)  st.11 = 値  /  値 = st.11   (lpoke/lpeek も可)
; dwReserved2 : DWORD (+48, 4byte)  st.12 = 値  /  値 = st.12   (lpoke/lpeek も可)
; liSYN : LONGLONG (+56, 8byte)  qpoke st,56,値 / qpeek(st,56)  ※IronHSPのみ。3.7/3.8は lpoke st,56,下位 : lpoke st,60,上位
; liTotalLogged : LONGLONG (+64, 8byte)  qpoke st,64,値 / qpeek(st,64)  ※IronHSPのみ。3.7/3.8は lpoke st,64,下位 : lpoke st,68,上位
; dwLostLogEntries : DWORD (+72, 4byte)  st.18 = 値  /  値 = st.18   (lpoke/lpeek も可)
; FilterInfo : PF_FILTER_STATS (+80, 72byte)  varptr(st)+80 を基点に操作(72byte:入れ子/配列)
; ※4byte境界の整数は添字 st.N(N=オフセット/4)で読み書き可。それ以外は peek/poke 系を使用。

; IronHSP は NSTRUCT(構造体)をサポート。32bit/64bit どちらでも同じコードで動作します。
; ※GUID・入れ子構造体はデフォルト型でないため、依存する #defstruct を先に定義(下記に同梱)。
#defstruct global PF_FILTER_DESCRIPTOR
    #field int dwFilterFlags
    #field int dwRule
    #field int pfatType
    #field intptr SrcAddr
    #field intptr SrcMask
    #field intptr DstAddr
    #field intptr DstMask
    #field int dwProtocol
    #field int fLateBound
    #field short wSrcPort
    #field short wDstPort
    #field short wSrcPortHighRange
    #field short wDstPortHighRange
#endstruct

#defstruct global PF_FILTER_STATS
    #field int dwNumPacketsFiltered
    #field PF_FILTER_DESCRIPTOR info
#endstruct

#defstruct global PF_INTERFACE_STATS
    #field intptr pvDriverContext
    #field int dwFlags
    #field int dwInDrops
    #field int dwOutDrops
    #field int eaInAction
    #field int eaOutAction
    #field int dwNumInFilters
    #field int dwNumOutFilters
    #field int dwFrag
    #field int dwSpoof
    #field int dwReserved1
    #field int dwReserved2
    #field int64 liSYN
    #field int64 liTotalLogged
    #field int dwLostLogEntries
    #field PF_FILTER_STATS FilterInfo 1
#endstruct

stdim st, PF_INTERFACE_STATS        ; NSTRUCT 変数を確保
st->dwFlags = 100
mes "dwFlags=" + st->dwFlags

PF_INTERFACE_STATS

フィールド

各言語での定義

HSP用 定義

HSP用定義