Forums

[sumitani]

Oh, I see. This is the behavior that I getting here.

Regarding the multiply layers driver. When you refer to the layers, are you referring to the layer defined in the STATIC_FILTER structure (DATALINK, NETWORK, TRANSPORT) or the multiple STATIC_FILTERS for each CNdisApi instance without override?

Using different layers for each application, both of them cannot intercept the same packet?

[sumitani]

It is not possible to instantiate more than one CNdisApi class to apply different filters for each protocol? Using only the filter as you said worked well for TCP.

[sumitani]

I sent the wrong parameter in m_dwDirectionFlags.

This is the first filter, to capture only outbound TCP:

m_Adapter.QuadPart = 0;
m_ValidFields = NETWORK_LAYER_VALID;
m_FilterAction = FILTER_PACKET_REDIRECT;
m_dwDirectionFlags = PACKET_FLAG_ON_SEND;

m_NetworkFilter.m_dwUnionSelector = IPV4;
m_NetworkFilter.m_IPv4.m_ValidFields = IP_V4_FILTER_PROTOCOL;
m_NetworkFilter.m_IPv4.m_Protocol = IPPROTO_TCP;

Then the second pass the other packets:
m_Adapter.QuadPart = 0;
m_dwDirectionFlags = PACKET_FLAG_ON_SEND;
m_FilterAction = FILTER_PACKET_PASS;

This combination is not working, I need to change the approach and filter the ICMP and UDP in order to capture TCP?

[Author]

Posts