Windows Filtering Platform (WFP) is a set of API and system services that provide a platform for creating network filtering applications. The WFP API allows developers to write code that interacts with the packet processing that takes place at several layers in the networking stack of the operating system. Network data can be filtered and also modified before it reaches its destination.
It has been observed that when WFP drivers are registered on a computer, the network throughput can be significantly decreased and the CPU usage can be significantly increased (on one or more cores).
The overhead to invoke the WFP drivers is sufficient in itself to cause the decreased network throughput and the increased CPU usage. There is no individual module that contributes to the CPU usage - the cost is built up across the entire WFP implementation.
Stream Filters have the largest effect on the performance. Transport Filters (with or without a Stream Filter present) have marginal effect on the performance.
The network throughput achieved is dependent upon these CPU based factors:
· The speed of processor(s) · The number of cores · The rate and affinity of ISRs · The rate and affinity of DPCs · The amount of WFP processing
DPC starvation plays a significant role in the network throughput achieved. When there are continual ISR interruptions, the DPC processing lags and acknowledgements are not processed in a timely fashion. This leads to a full receive buffer and an eventual catch-up period where new packet processing is halted. Changing the size of the receive buffer (from 4k to 64k) has a positive effect on the scheduling as this affects the ISR rate. Changing the NIC vendor also affects the throughput as each NIC vendor fires ISRs at different rates.
Laptops with lower-end processors are very susceptible to scheduling conflicts and accordingly have a more dramatic decrease in network throughput compared to other computers (laptops, desktops, servers) equipped with high-end processors. Laptops that lower their processor speed when AC power is unavailable are further affected due to the reduced amount of CPU resource.
Microsoft has reviewed the Windows Filtering Platform (WFP) implementation for the products listed. The WFP overhead is deemed to be by-design.
Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Datacenter without Hyper-V, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Enterprise without Hyper-V, Windows Server 2008 R2 Standard, Windows Server 2008 R2 Standard without Hyper-V, Windows Server 2008 Standard, Windows Server 2008 Standard without Hyper-V, Windows Server 2012 Datacenter, Windows Server 2012 Essentials, Windows Server 2012 Foundation, Windows Server 2012 Hyper-V, Windows Server 2012 Standard, Windows 7 Enterprise, Windows 7 Home Basic, Windows 7 Professional, Windows 7 Ultimate, Windows 8, Windows 8 Enterprise, Windows 8 Pro