Is CIS using Windows Filtering Platform (WFP) or what?

I am told CIS 6 and 7 do not support MTU values over 1500 bytes (no jumbo frames) because of the Windows filtering support it uses. Is CIS using Windows Filtering Platform (WFT) or some other filter driver support from Windows? Thanks and enjoy, John.

Can you explain the problem for people?

Thanks, clockwork. Please see this Bug Report. Chiron asked me to open this thread. Enjoy, John.


CIS uses WFP in conjunction with inspect.sys packet filter driver. Inspect runs at the lowest level (kernel level) where WFP runs at higher levels. I don’t know the specifics about WFP works or how CIS uses it.

According to Comodo devs due to limitations of the WFP Jumbo Frames cannot be sent. Unless Comodo decides not to use WFP or Microsoft fixes the MTU limitations of WFP we are in a tie. :-\

Thanks much, EricJH. I will do some more research on WFP - would like to get Jumbo frames working with CIS FW active. Enjoy, John.

I have just started researching WFP and ran across this post in OSR Online. I may be way off base, but is this path a possibility to allow jumbo frames? Thanks and enjoy, John.

The OSR Online response to a question about setting the MTU defines a couple of Keys with value (Inspect.inf uses these settings) and references how to use the LWF (Light Weight Filter) “FilterRestart handler” to change the MTU. It looks like to me that this is what the users need to be able to use Jumbo Frames (MTU > 1500 bytes). Please consider it. Thanks and enjoy, John.

I am having difficulty finding any web reference that suggests WFP actually has an MTU limit. Can anyone supply a link?

This ref is not explicit, but relates an experiment with a high performance network and Jumbo frames that uses Windows Filtering Platform (though its not clear how):

Best wishes. Mike.