For outgoing packets: in FilterSendNetBufferLists,
you go thru the list and find packets you want to drop.
AFAIK, each NetBuffer is a L2 packet; also, all NetBuffers
in a single list should be sent by same protocol driver, to same
destination ip and port.
If you find a packet (= NetBuffer) to drop, create a new NBL
(since you can't modify the NBL passed by the protocol driver),
add to it the remaining NBs and send this down.
Suspend the original send operation until the lower
driver completes your NBL, then complete the original send
operation.
Something along these lines.
Regards,
--PA