You want to know the function of the Teefer2 driver.
The Teefer2 driver is responsible for capturing all network traffic entering, or leaving, a particular interface so that the packets may pass to the personal firewall component of the Symantec Endpoint Protection (SEP) client for analysis.
The Teefer2 driver works in tandem with its associated miniport driver.
The Teefer2 driver runs in kernel mode, and passes information to teefer.dll for user-mode operations.
All inbound and outbound traffic is filtered through this driver, and the firewall rules apply to all traffic passing through it.
Please note that it is not possible to disable the Teefer2 driver without removing the SEP firewall component.
More information on the Symantec Endpoint Protection firewall can be found in the Symantec Endpoint Protection Windows Client Guide and the Symantec Endpoint Protection Installation and Administration Guide.