Skip to content

Instantly share code, notes, and snippets.

@Cyb3rWard0g

Cyb3rWard0g/windows_filtering_platform_layers.xml

Created October 4, 2018 05:53
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
Star You must be signed in to star a gist
Embed
What would you like to do?
Learn more about clone URLs
Download ZIP
Raw
windows_filtering_platform_layers.xml
This file has been truncated, but you can view the full file.
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<wfpstate>
<timeStamp>2018-10-04T05:38:46.705Z</timeStamp>
<sessions numItems="15">
<item>
<sessionKey>{3c1f4d46-4e9d-4fab-bcb5-00c5403ee1cd}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>488</processId>
<sid>S-1-5-20</sid>
<username>NT AUTHORITY\NETWORK SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{314f4262-57b8-414f-9b37-af635ab553eb}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{9825d111-3d28-4b37-a6fb-f40b3c6bcd2b}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{57379ce8-313c-49cc-8701-144fefb705b2}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{6667406c-c873-499e-b2a5-5d3619a4d2cf}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{de5bf023-20ad-45e5-8b8f-adafa3a4b5ad}</sessionKey>
<displayData>
<name>POLICYAGNT</name>
<description>PolicyAgent Session</description>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>300000</txnWaitTimeoutInMSec>
<processId>1776</processId>
<sid>S-1-5-20</sid>
<username>NT AUTHORITY\NETWORK SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{3fb22358-90e8-49b5-ba86-95d331bf2724}</sessionKey>
<displayData>
<name>Windows Defender Firewall Dynamic Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>18000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{40cce534-a34e-46cf-82f4-5d5813b36d25}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{d45ca2c2-ca58-4836-bae5-36726e407979}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{76f7c8ce-12d7-433b-9a9d-814b2e23adce}</sessionKey>
<displayData>
<name>Modern Network Isolation Diagnostics Bfe Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>18000000</txnWaitTimeoutInMSec>
<processId>1988</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{6f2b4fb3-f176-45ed-aa26-886c77fb3ffb}</sessionKey>
<displayData>
<name>Teredo Callback Session</name>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>1104</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{118aaab5-c97c-4258-b69d-c60b54f7a04b}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>2388</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{15fbeb7a-240a-495e-aeed-ee4f27e480af}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags numItems="1">
<item>FWPM_SESSION_FLAG_DYNAMIC</item>
</flags>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>2388</processId>
<sid>S-1-5-18</sid>
<username>NT AUTHORITY\SYSTEM</username>
<kernelMode>false</kernelMode>
</item>
<item>
<sessionKey>{12dd6e01-0a86-4c83-b672-b186c0cbe1a0}</sessionKey>
<displayData>
<name/>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>6000000</txnWaitTimeoutInMSec>
<processId>4080</processId>
<sid>S-1-5-19</sid>
<username>NT AUTHORITY\LOCAL SERVICE</username>
<kernelMode>true</kernelMode>
</item>
<item>
<sessionKey>{cd64ba98-4c29-4321-8c36-71d08d500b7b}</sessionKey>
<displayData>
<name>wfputil</name>
<description/>
</displayData>
<flags/>
<txnWaitTimeoutInMSec>4294967295</txnWaitTimeoutInMSec>
<processId>3844</processId>
<sid>S-1-5-21-3825400013-1856045589-1834093677-1001</sid>
<username>DESKTOP-WARDOG\wardog</username>
<kernelMode>false</kernelMode>
</item>
</sessions>
<layers numItems="103">
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4</layerKey>
<displayData>
<name>Inbound IP Packet v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>0</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD</layerKey>
<displayData>
<name>Inbound IP Packet v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>1</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6</layerKey>
<displayData>
<name>Inbound IP Packet v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>2</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD</layerKey>
<displayData>
<name>Inbound IP Packet v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>3</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4</layerKey>
<displayData>
<name>Outbound IP Packet v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>4</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD</layerKey>
<displayData>
<name>Outbound IP Packet v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>5</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6</layerKey>
<displayData>
<name>Outbound IP Packet v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>6</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD</layerKey>
<displayData>
<name>Outbound IP Packet v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="10">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>7</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V4</layerKey>
<displayData>
<name>IP Forward v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>8</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Inbound Tunnel v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V4</applicableLayer>
<calloutId>9</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Outbound Tunnel v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V4</applicableLayer>
<calloutId>11</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V4_DISCARD</layerKey>
<displayData>
<name>IP Forward v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>9</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V6</layerKey>
<displayData>
<name>IP Forward v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>10</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Inbound Tunnel v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V6</applicableLayer>
<calloutId>10</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Forward Outbound Tunnel v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over a tunnel mode security association.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_IPFORWARD_V6</applicableLayer>
<calloutId>12</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_IPFORWARD_V6_DISCARD</layerKey>
<displayData>
<name>IP Forward v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_SOURCE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_FORWARD_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_ARRIVAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_ARRIVAL_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_PHYSICAL_NEXTHOP_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_NEXTHOP_INTERFACE_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>11</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4</layerKey>
<displayData>
<name>Inbound Transport v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>12</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Transport v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>1</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel v4 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>5</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</layerKey>
<displayData>
<name>Inbound Transport v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>13</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V4_SILENT_DROP</calloutKey>
<displayData>
<name>WFP Built-in Silent Drop Transport v4 Discard Layer Callout</name>
<description>Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000040</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD</applicableLayer>
<calloutId>17</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6</layerKey>
<displayData>
<name>Inbound Transport v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>14</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Transport v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a transport mode security association arrives securely.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>2</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Inbound Tunnel v6 Layer Callout</name>
<description>Verifies that each received packet that is supposed to arrive over a tunnel mode security association arrives securely.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>6</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</layerKey>
<displayData>
<name>Inbound Transport v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="15">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>15</layerId>
</layer>
<callouts numItems="1">
<item>
<calloutKey>FWPM_CALLOUT_WFP_TRANSPORT_LAYER_V6_SILENT_DROP</calloutKey>
<displayData>
<name>WFP Built-in Silent Drop Transport v6 Discard Layer Callout</name>
<description>Implements stealth-mode filtering by silently dropping all incoming packets for which TCP does not have a listening endpoint.</description>
</displayData>
<flags numItems="3">
<item>FWP_CALLOUT_FLAG_ALLOW_OFFLOAD</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000040</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD</applicableLayer>
<calloutId>18</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</layerKey>
<displayData>
<name>Outbound Transport v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>16</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Transport v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>3</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Tunnel v4 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V4</applicableLayer>
<calloutId>7</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD</layerKey>
<displayData>
<name>Outbound Transport v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>17</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</layerKey>
<displayData>
<name>Outbound Transport v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>18</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Transport v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over transport mode security associations.</description>
</displayData>
<flags numItems="2">
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000060</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>4</calloutId>
</item>
<item>
<calloutKey>FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6</calloutKey>
<displayData>
<name>WFP Built-in IPsec Outbound Tunnel v6 Layer Callout</name>
<description>Indicates to IPsec the outbound traffic that must be secured over tunnel mode security associations.</description>
</displayData>
<flags numItems="3">
<item>FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
<item>00000020</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_OUTBOUND_TRANSPORT_V6</applicableLayer>
<calloutId>8</calloutId>
</item>
</callouts>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD</layerKey>
<displayData>
<name>Outbound Transport v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="16">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_CURRENT_PROFILE_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IPSEC_SECURITY_REALM_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_BYTE_BLOB_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>19</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
<displayData>
<name>Stream v4 Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>20</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0414}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Connection-oriented protocol packet inspection.</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V4</applicableLayer>
<calloutId>288</calloutId>
</item>
<item>
<calloutKey>{d67b238d-d80c-4ba7-96df-4a0c83464fa7}</calloutKey>
<displayData>
<name>windefend_stream_v4</name>
<description>windefend</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V4</applicableLayer>
<calloutId>290</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{42e67750-e0ae-4ec7-aa42-97c6605b1c96}</filterKey>
<displayData>
<name>windefend_stream_v4</name>
<description>windefend</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<layerKey>FWPM_LAYER_STREAM_V4</layerKey>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>{d67b238d-d80c-4ba7-96df-4a0c83464fa7}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>66191</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V4_DISCARD</layerKey>
<displayData>
<name>Stream v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>21</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
<displayData>
<name>Stream v6 Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>22</layerId>
</layer>
<callouts numItems="2">
<item>
<calloutKey>{c3dbed20-0bb6-4bf3-828d-96732e1e0416}</calloutKey>
<displayData>
<name>Windows Firewall: callout</name>
<description>Connection-oriented protocol packet inspection.</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V6</applicableLayer>
<calloutId>289</calloutId>
</item>
<item>
<calloutKey>{36d4cf95-fd3a-4bb8-90a9-ffdb3749237f}</calloutKey>
<displayData>
<name>windefend_stream_v6</name>
<description>windefend</description>
</displayData>
<flags numItems="2">
<item>FWP_CALLOUT_FLAG_CONDITIONAL_ON_FLOW</item>
<item>FWPM_CALLOUT_FLAG_REGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<applicableLayer>FWPM_LAYER_STREAM_V6</applicableLayer>
<calloutId>291</calloutId>
</item>
</callouts>
<filters numItems="1">
<item>
<filterKey>{094b9bb6-e451-4069-ac23-5fe695ec9662}</filterKey>
<displayData>
<name>windefend_stream_v6</name>
<description>windefend</description>
</displayData>
<flags numItems="1">
<item>FWPM_FILTER_FLAG_PERMIT_IF_CALLOUT_UNREGISTERED</item>
</flags>
<providerKey/>
<providerData/>
<layerKey>FWPM_LAYER_STREAM_V6</layerKey>
<subLayerKey>{3c1cd879-1b8c-4ab4-8f83-5ed129176ef3}</subLayerKey>
<weight>
<type>FWP_EMPTY</type>
</weight>
<filterCondition/>
<action>
<type>FWP_ACTION_CALLOUT_TERMINATING</type>
<filterType>{36d4cf95-fd3a-4bb8-90a9-ffdb3749237f}</filterType>
</action>
<rawContext>0</rawContext>
<reserved/>
<filterId>66192</filterId>
<effectiveWeight>
<type>FWP_UINT64</type>
<uint64>0</uint64>
</effectiveWeight>
</item>
</filters>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_STREAM_V6_DISCARD</layerKey>
<displayData>
<name>Stream v6 Discard Layer</name>
<description/>
</displayData>
<flags numItems="4">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
<item>FWPM_LAYER_FLAG_BUFFERED</item>
</flags>
<field numItems="8">
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>23</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4</layerKey>
<displayData>
<name>Datagram Data v4 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>24</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD</layerKey>
<displayData>
<name>Datagram Data v4 Discard Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
</field>
<defaultSubLayerKey>FWPM_SUBLAYER_UNIVERSAL</defaultSubLayerKey>
<layerId>25</layerId>
</layer>
<callouts/>
<filters/>
</item>
<item>
<layer>
<layerKey>FWPM_LAYER_DATAGRAM_DATA_V6</layerKey>
<displayData>
<name>Datagram Data v6 Layer</name>
<description/>
</displayData>
<flags numItems="3">
<item>FWPM_LAYER_FLAG_KERNEL</item>
<item>FWPM_LAYER_FLAG_BUILTIN</item>
<item>FWPM_LAYER_FLAG_CLASSIFY_MOSTLY</item>
</flags>
<field numItems="14">
<item>
<fieldKey>FWPM_CONDITION_IP_PROTOCOL</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_ADDRESS</fieldKey>
<type>FWPM_FIELD_IP_ADDRESS</type>
<dataType>FWP_BYTE_ARRAY16_TYPE</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT8</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_REMOTE_PORT</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT16</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_IP_LOCAL_INTERFACE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT64</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_SUB_INTERFACE_INDEX</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_DIRECTION</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_FLAGS</fieldKey>
<type>FWPM_FIELD_FLAGS</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_INTERFACE_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_TUNNEL_TYPE</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item>
<item>
<fieldKey>FWPM_CONDITION_COMPARTMENT_ID</fieldKey>
<type>FWPM_FIELD_RAW_DATA</type>
<dataType>FWP_UINT32</dataType>
</item><