Get remote host name on a network shared file access in mini-filter driver

[jay96]

I am writing a mini-filter driver to allow or block Network shared file access for specific hosts in a network. I have detected for Any network access with the SourceName field using SeQueryInformationToken().

If the SourceName field is NtLmSsp the request is from the network.

Till now I can Only detect the network file access But somehow I am not able to find out the HostName/IP for the remote machine.

How can I identify the remote IP/host Name in network shared file access?

Any hints/ideas will be much appreciated.

Thanks.

Platform: Windows, Language: c

Continue reading...