i'm working on modifying how windows (xp) handles certain packets. for example, right now i'm trying to prevent windows from returning a RST when someone tries sending a (SYN-)ACK to a closed port. i'm assuming that this is controlled by tcpip.sys, but i'm not positive. has anyone done any work in this area before?