Divert
Divert copied to clipboard
windivert produce two close event for every udp socket close operation on windows 11 ,but work as intended on windows 10 .
trafficstars
I was using windows 11 22H2, and socketdump.exe "event == CLOSE and udp"
The SOCKET_CLOSE event could be indicated twice: once for ipv4 and once more for ipv6. It may depend if an ipv4/ipv6 packet was observed during testing. I think this is probably what happened.