The TCP protocol uses a three-way handshake to establish a TCP connection. The last interaction in the three-way handshake is a TCP Acknowledgement (ACK) package. However, in Windows Vista, the Windows Filtering Platform (WFP) inspection occurs only after the three-way handshake is completed. Therefore, any data that is piggybacked on the ACK package may bypass the WFP inspection process.

Note: A payload can legitimately piggyback on the ACK package.

This issue affects socket applications that use NetBIOS communication on a Windows Vista-based computer.

Windows Filtering Platform: A new architecture in Windows Vista that allows unprecedented access to the TCP/IP packet processing path, wherein outgoing and incoming packets can be examined or changed before allowing them to be processed further.

Consider the following scenario. You develop a Windows Filtering Platform (WFP) driver. You install the WFP driver on a Windows Vista-based computer. In this scenario, some applications and services appear to stop responding for 15 seconds when a Domain Name System (DNS) lookup occurs. This problem occurs if the applications or the services use the DNS function.

In Windows Vista, the Windows Filtering Platform (WFP) includes a Performance Monitor counter that displays how many network filtering policy providers are registered on the computer. However, this counter displays is more than the number of audits that you find in Event Viewer.