Windows 2000 TCP/IP Packet Filtering Guide

Microsoft Windows 2000 includes a native, basic packet-filtering mechanism built directly into its TCP/IP networking stack known as TCP/IP Filtering. This feature provides rudimentary security by evaluating incoming network packets against administrator-defined allowlists for IP protocols, TCP ports, and UDP ports. Operating as a stateless inbound filter, it inspects network traffic before delivering it to listening services, allowing systems to limit exposed network surfaces without requiring third-party firewall software.

Architecture and Scope of TCP/IP Filtering

In Windows 2000, TCP/IP filtering is implemented at the transport and network layers through the core TCP/IP protocol driver (Tcpip.sys).

Key architectural characteristics include:

  • Inbound-Only Inspection: The filter evaluates only incoming (ingress) traffic. Outbound (egress) traffic generated by the local system is not restricted.
  • Stateless Operation: The mechanism does not track the state of active sessions. It treats every incoming packet independently, meaning return traffic for outbound requests is evaluated using the exact same static rules as unsolicited incoming requests.
  • Global Scope: Although configured through network interface properties, the rules defined in TCP/IP Filtering apply globally to all network adapters on the host running the TCP/IP stack.

Filter Configuration Parameters

Windows 2000 organizes packet filtering into three distinct categories:

  1. IP Protocols: Filters based on the 8-bit Protocol field in the IPv4 header (e.g., Protocol 6 for TCP, Protocol 17 for UDP, Protocol 1 for ICMP).
  2. TCP Ports: Filters incoming packets directed at local Transmission Control Protocol listening ports.
  3. UDP Ports: Filters incoming packets directed at local User Datagram Protocol listening ports.

Each category supports two operational states:

  • Permit All: The default setting. All incoming traffic corresponding to this category is accepted.
  • Permit Only: An allowlist model. Traffic is dropped unless the protocol number or destination port is explicitly declared in the permitted list.

Packet Processing Flow

When a network packet reaches a Windows 2000 host, the built-in filtering mechanism evaluates it through a sequential process:

  1. Frame Reception: The Network Interface Card (NIC) receives the frame and passes it to the Network Driver Interface Specification (NDIS) wrapper, which hands the IP datagram to Tcpip.sys.
  2. Filter State Verification: The driver checks whether the "Enable TCP/IP Filtering" option is active. If disabled, the packet bypasses filtering and proceeds directly to normal protocol processing.
  3. IP Protocol Verification:
    • If IP Protocol filtering is set to "Permit Only," the driver inspects the protocol number in the IPv4 header.
    • If the protocol is not present in the allowed list, the packet is silently discarded.
    • If the protocol is explicitly allowed, processing continues.
  4. Transport Layer Port Verification:
    • TCP Traffic: If the IP protocol is TCP (Protocol 6) and TCP Port filtering is set to "Permit Only," the driver evaluates the destination port in the TCP header. If the port is listed, the packet is accepted; otherwise, it is silently dropped.
    • UDP Traffic: If the IP protocol is UDP (Protocol 17) and UDP Port filtering is set to "Permit Only," the driver checks the destination port in the UDP header. If listed, the packet is accepted; otherwise, it is silently dropped.
    • Other Protocols: Packets utilizing other permitted protocols (such as ICMP or GRE) are passed up the stack without port evaluation, as they do not utilize TCP/UDP transport headers.
  5. Disposition and Delivery: Packets passing all configured checks are dispatched to the appropriate upper-layer socket or service. Discarded packets generate no response; the driver does not send an ICMP Destination Unreachable message, preventing port scanning tools from easily mapping closed versus filtered states.