Architecture and run-time environment for network filter drivers

In a computing device that may be communicatively coupled to a network by one or more communication paths and that includes one or more protocol stacks associated one or more filter instances that may perform filtering operations on packets, a method for filtering packets associated with the one or more protocols so as to conserve processor and network resources, the method comprising:

• an act of a filter instance receiving an input packet;
• an act of bypassing a first set of filtering operations when the input packet is transferred across a communication path from a data link layer to a transport layer and bypassing a second set of filtering operations when the input packet is transferred across a communication path from a transport layer to a data link layer;
• and
• an act of sending an output packet that may differ from the input packet if a filtering operation was performed.

In a computing device that may be communicatively coupled to a network by one or more communication paths and that includes one or more protocol stacks associated one or more filter instances that may perform filtering operations on packets, a method for filtering packets associated with the one or more protocols so as to conserve processor and network resources, the method comprising:

• an act of a processing a packet currently being transferred across a communication path;
• an act of the packet completely bypassing a first filter instance in the communication path because the first filter instance was configured to operate in bypass mode for the communication path;
• and
• an act of the packet being received by a second filter instance in the communication path that was configured to receive packets being transferred across the communication path.

A computer program product for implementing, in a computing device that may be communicatively coupled to a network by one or more communication paths and that includes one or more protocol stacks associated with an abstract interface that manages a filter stack, the filter stack including one or more filter instances that may perform filtering operations on portions of packets, a method for filtering packets associated with the one or more protocols so as to conserve processor and network resources, the computer program product comprising:

• a computer-readable medium carrying computer-executable instructions, that when executing at the computing device cause the computing device to perform the method, including:
• an act of processing an input packet;
• an act of the input packet bypassing one or more of the filtering operations associated with a filter instance;
• and
• an act of sending an output packet that may differ from the input packet if a filtering operation was performed on the input packet.