An operation of Windows Filtering Platform (WFP) which provides enforcement for security policies by, in each case, trapping the event, determine what application initiated it, and query the filter engine to determine whether the socket should be allowed to proceed.