tcp - Windows NDIS filter - how to check if port is used by operating system -

i writing windows ndis filter driver , able query inside kernel status of tcp port (is in use?). when driver in irql = dispatch_level, can use wsk network api or else query if port being used operating system?

thanks in advance!

afaik, there no visible (read: documented) method doing that. 1 option use gettcptable2, parse , send information driver using ioctl. see this question example how usermode, you'll have add work process , send down driver.

it possible go through less preferable way of reverse engineering api used gettcptable2 , use yourself. see discussion in osr, including few leads , few reasons why not it.