A class filter driver will attach to all device instances of that class. For instance,
all keyboard port drivers will have kbdclass as an upper filter, regardless of
the device plugged into the system. Let's assume that you have two of the same
USB keyboard and both are plugged in. Each device will have its own PnP device
stack and kbdclass will be loaded on each instance.
On the other hand, a device filter driver will only attach to device instances
on which it was installed. It is installed relative to the device instance for
each device instance. This means every time you install the device, the
device filter must also be installed if you want to filter that device. Compare this to the class filter which
is installed only once and is loaded automaticall for all device instances of that
class. Let's take the previous example of the 2 keyboards plugged in at the same time.
With a device filter you can selectively filter the first instance while leaving the
second instance unfiltered.
Note that the distinction between a class and device filter is made on the device object level, not the driver. This means that a driver could be installed as a class filter as well as a device filter. I am not sure how useful it would be to have a driver implementing both roles, but it is certainly possible.
Why would you pick one over the other? Well it depends on what you are trying
to do in your filter driver and the device class. Let's say you have a HID device
which is not spec compliant and sends an extra byte on each transfer. In this case you would
create a device filter and modify the data for only your device instance, leaving all the
other HID devices alone. On the other hand, let's say you want to know about
every key press in the system. In this case you want a class filter so that you
can get the data from all instances of that device class in the system.