能否通过WFP过滤流量同时保留Winsock SIO_RCVALL的监听能力？

我正在开发一款C++应用，通过WSAIoctl/WSARecv传入SIO_RCVALL标志以混杂模式拦截所有流量，目标是有状态地阻断不符合特定条件的流量。以UDP 5000端口为例，期望实现：自身持续监控该端口流量，同时让其他应用无法接收该端口的流量。

我尝试了以下WFP规则方案：

SIO_RCVALL匹配规则 #

fwpFilter.layerKey = FWPM_LAYER_INBOUND_TRANSPORT_V4;
fwpFilter.flags = FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT;
fwpFilter.action.type = FWP_ACTION_PERMIT;
fwpFilter.subLayerKey = GetSublayerKey();

fwpFilter.weight.type = FWP_UINT8;
fwpFilter.weight.uint8 = 0xF; // High weight
fwpFilter.numFilterConditions = 1;
fwpFilter.filterCondition = fwpFilterConditions;
fwpFilter.displayData.name = const_cast<wchar_t*>(L"Allow Promiscuous");
fwpFilter.displayData.description = const_cast<wchar_t*>(L"Support all traffic capture.");
fwpFilter.flags = FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT; // Prevent BLOCK by other rules/layers?

fwpFilterConditions[0].fieldKey = FWPM_CONDITION_FLAGS;
fwpFilterConditions[0].matchType = FWP_MATCH_FLAGS_ALL_SET;
fwpFilterConditions[0].conditionValue.type = FWP_UINT32;
fwpFilterConditions[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_RAW_ENDPOINT; // Match to raw socket with no further conditions

特定流量阻断规则 #

fwpFilter.layerKey = FWPM_LAYER_INBOUND_TRANSPORT_V4;
fwpFilter.action.type = FWP_ACTION_BLOCK;
fwpFilter.subLayerKey = GetSublayerKey();

fwpFilter.weight.type = FWP_UINT8; // Medium Weight
fwpFilter.weight.uint8 = 0xA;
fwpFilter.numFilterConditions = 3;
fwpFilter.filterCondition = fwpFilterConditions;
fwpFilter.displayData.name = const_cast<wchar_t*>(L"Block specific");
fwpFilter.displayData.description = const_cast<wchar_t*>(L"Port/IP specific block.");

fwpFilterConditions[0].fieldKey = FWPM_CONDITION_FLAGS;
fwpFilterConditions[0].matchType = FWP_MATCH_FLAGS_NONE_SET;
fwpFilterConditions[0].conditionValue.type = FWP_UINT32;
fwpFilterConditions[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_RAW_ENDPOINT;

fwpFilterConditions[1].fieldKey = FWPM_CONDITION_IP_LOCAL_PORT;
fwpFilterConditions[1].matchType = FWP_MATCH_EQUAL;
fwpFilterConditions[1].conditionValue.type = FWP_UINT16;
fwpFilterConditions[1].conditionValue.uint16 = sourcePort;

fwpFilterConditions[2].fieldKey = FWPM_CONDITION_IP_REMOTE_ADDRESS;
fwpFilterConditions[2].matchType = FWP_MATCH_EQUAL;
fwpFilterConditions[2].conditionValue.type = FWP_UINT32;
fwpFilterConditions[2].conditionValue.uint32 = sourceIP;

异常行为 #

规则生效后，当有应用绑定本地UDP 5000端口时，所有应用（包括我的监控应用）的该端口流量都被阻断；解绑端口后，我的SIO_RCVALL应用可正常捕获流量。

我清楚使用callout驱动更高效灵活，但希望尽可能避免开发驱动，故在此确认是否有纯用户态的可行方案。

内容的提问来源于stack exchange，提问作者MDC