Server Network freeze when I use WinpkFilter

Home Forums Discussions Support Portal Server Network freeze when I use WinpkFilter

This topic contains 7 replies, has 3 voices, and was last updated by  Vadim Smirnov 5 years, 10 months ago.

Viewing 8 posts - 1 through 8 (of 8 total)
  • Author
    Posts
  • #5362

    madnik7
    Participant

    I modify gretunnel to just monitor incoming packet without do anything, but when I send just 5000 UDP packet with 200 byte size, I loose server connection for 2 min! I will be useless for me in such case.

    My server is Windows 2008 R2 x64 on HyperV
    My code compiled as 32 bit application
    My network is 2Mbit internet connection
    If I dont run the code I have not such issue, it mean there is not relate to firewall or routers
    I am using the latest version of WinpkFilter 3.0.8.0

    int main(int argc, char* argv[])
    {
    Test(5, 100);
    }

    void Test(int index, int counter)
    {
    ETH_REQUEST Request;
    INTERMEDIATE_BUFFER PacketBuffer;
    ether_header* pEthHeader = NULL;
    iphdr* pIpHeader = NULL;

    if(!api.IsDriverLoaded())
    {
    printf ("Driver not installed on this system of failed to load.n");
    return;
    }

    api.GetTcpipBoundAdaptersInfo ( &AdList );

    if ( iIndex + 1 > AdList.m_nAdapterCount )
    {
    printf("There is no network interface with such index on this system.n");
    return;
    }


    ADAPTER_MODE Mode;
    Mode.dwFlags = MSTCP_FLAG_SENT_TUNNEL|MSTCP_FLAG_RECV_TUNNEL;
    Mode.hAdapterHandle = (HANDLE)AdList.m_nAdapterHandle[iIndex];

    // Create notification event
    hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);

    // Set event for helper driver
    if ((!hEvent)||(!api.SetPacketEvent((HANDLE)AdList.m_nAdapterHandle[iIndex], hEvent)))
    {
    printf ("Failed to create notification event or set it for driver.n");
    return;
    }

    atexit (ReleaseInterface);

    // Initialize Request
    ZeroMemory ( &Request, sizeof(ETH_REQUEST) );
    ZeroMemory ( &PacketBuffer, sizeof(INTERMEDIATE_BUFFER) );
    Request.EthPacket.Buffer = &PacketBuffer;
    Request.hAdapterHandle = (HANDLE)AdList.m_nAdapterHandle[iIndex];

    api.SetAdapterMode(&Mode);

    while (counter != 0)
    {
    WaitForSingleObject ( hEvent, INFINITE );

    while(api.ReadPacket(&Request))
    {
    bool send = PacketBuffer.m_dwDeviceFlags == PACKET_FLAG_ON_SEND;
    //ether_header_ptr ethHeader = (ether_header*)Request.EthPacket.Buffer->m_IBuffer;

    counter--;
    if (counter%100==0)
    printf("Counter:%dn", counter);

    if (send)
    {
    // Place packet on the network interface
    api.SendPacketToAdapter(&Request);
    }
    else
    {
    // Indicate packet to MSTCP
    api.SendPacketToMstcp(&Request);
    }

    if (counter == 0)
    {
    printf ("Filtering completen");
    break;
    }
    }

    ResetEvent(hEvent);
    }
    }
    #7045

    yegorov-p
    Participant

    Maybe there is something with your packet queue?

    Manual says that if you don’t read packets from the queue (with CNdisApi::ReadPacket) or release the queued packets directly by calling CNdisApi::FlushAdapterPacketQueue then after the queue reaches it’s maximum limit all network activities will be frozen.

    #7046

    madnik7
    Participant

    Tanks for your reply.
    Would you tell me whats wrongs in my code? The code is so simple and it even does not process that packet but it got frozen.
    Would you help me?
    Regards

    #7047

    Vadim Smirnov
    Moderator

    I can’t see if your filter application really does anything except console output. However, please note that console output is relatively slow thing and if you call it for every packet this cause a serious delay for each packet processing, thus causing slower reading packets from the queue. May be this was a problem in you case, however, I have not been expecting your code thoroughly. Why you just don’t use the tha passthru sample instead compiled with no console output?

    #7048

    madnik7
    Participant

    Hi
    I know console is slow so I just print one counter per 100 packet:

    if (counter%100==0) 

    Actually the system network frozen for 1 min or more and when it back i see it even does not process much packet; it doesn’t print much message too.
    Actually the code is same ass passthru, as you say i check passthru sample too and I remark all printf output, but still same issue when I send many packet (10000 UDP packets) from client site.
    I really going to corporate with you to solve this issue, I can also send you my server admin password to you to check this issue yourself.

    #7049

    Vadim Smirnov
    Moderator

    WinpkFilter driver by default has 500 buffers for queing packets. When you send a large amount of packets on the network interface which is in the tunnel mode then driver internal queue is overloaded and network will be frozen until your user mode application process all these packets. So the reason is the application which does not process packets fast enough. May be it just does get enough CPU time. Try to assign packet filtering application a higher priority than your UDP sending application has. However, I don’t think that your network is really frozen, you rather expirience a huge packet drops because of massive UDP spoofing and this causes TCP resends and etc…

    #7050

    Vadim Smirnov
    Moderator

    P.S. You can also try PackThru sample which reads/writes blocks of packets from/to the driver and thus faster processes the queue.

    #7051

    Vadim Smirnov
    Moderator

    P.P.S. If you plan UDP spoofing on the network interface using large amounts of packets then it also may have sense to create a special WinpkFilter driver build with larger amount of packets buffers.

Viewing 8 posts - 1 through 8 (of 8 total)

You must be logged in to reply to this topic.