[nat32support]

Try disabling QUIC ports UDP 80 and 443.

This is because that protocol keeps a UID that identifies a user irrespective of IP address.

[nat32support]

If your question is about WinpkFilter driver internal buffers then for Windows Vista and later driver preallocates 1000 buffers for 1514 bytes sized packets.

Question: What happens if, for whatever reason, all 1000 buffers are filled before a receiver calls ReadPacket(hDriver, &Request)?

I ask because I’m observing that the driver locks up in this case. It can still send packets but doesn’t receive any.

If I wake it and flush the adapter queue, normal operation resumes.

[nat32support]

@matt wrote:

Hi Vadim,

Thanks for your response – yes, I agree with you – no point releasing for the Pi if you can’t go tweaking with it… just sit and wait for the moment I guess!

The Windows 10 stuff for the Pi is now here:

http://ms-iot.github.io/content/GetStarted.htm

It’s looking good because one can run C++ code on it and devcon.exe is supported, which means that device drivers can be installed.

[nat32support]

@siddappa wrote:

is there any limit for setting number of filters?? Also would it hit the performance if more and more filters gets added?

struct _STATIC_FILTER_TABLE{

unsigned long m_TableSize;

STATIC_FILTER m_StaticFilters[ANY_SIZE];

}

Regarding performance:
I’m assuming the driver searches filter table sequentially each time a packet is received. If so, the average search time will of course increase as the table becomes larger. You will just have to test this on your hardware to see how your software performs.

Note that if you were to pass each packet to your application and do the filtering there, performance will be very much worse, even if you use hashing to perform the filtering. The reason for this is that the kernel-user-kernel transitions are expensive. Tests I’ve done here with my software definitely confirm this.

[nat32support]

@siddappa wrote:

If there any way to track Download/upload Data in bytes for individual MAC address using Winpkfilter? If yes how should i proceed with implementation? Please share some pointers,so that i can dig further.

The filter mechanism can be used, because it records the number of packets and the number of bytes received for each match. So if you define individual filters for each MAC address of interest, you can then obtain those values by calling the GetPacketFilterTable function.

[nat32support]

@nat32support wrote:

@SerpentFly wrote:

To resolve an issue with DNS you can change all your filters from blocking to redirect and check filter ID in the DNS packets. So you can identify filter which selects DNS packets.

What is the “filter ID” and where is it to be found?

There is a variable called m_FilterID in structure INTERMEDIATE_BUFFER, but only in WinPkFilter 3.1.2 (and possibly later versions).

I had been using WinPkFilter 3.1.1, and it did not have such a variable.

[nat32support]

@SerpentFly wrote:

To resolve an issue with DNS you can change all your filters from blocking to redirect and check filter ID in the DNS packets. So you can identify filter which selects DNS packets.

What is the “filter ID” and where is it to be found?

[nat32support]

@SerpentFly wrote:

The event you set into driver with SetWANEvent is signaled when the new dial-up (VPN, PPPoE and etc…) connection is established or dropped, so you could reinitialize your configuration information. It is rather similar to SetAdapterListChangeEvent than SetPacketEvent which is signaled when new packet is queued.

I’ve noticed that the WAN event can occur _before_ the RAS_LINKS table has been fully updated. I’ve solved the problem for now by sleeping for 1000 msec before copying the table for further use in my software.

Is there any way of determining when the RAS_LINKS table is valid?

[Author]

Posts