Forum Replies Created
-
Posts
-
Samples can be compiled with VC6 or VC2005 (projects are provided). You can convert VC6 project to VC2003 one if necessary. The binaries in the package are built with VC6 in order to support Windows 95.
Подскажи пожалуйста в каком разделе в DDK это можно почитать?
Описание NdisRegisterProtocol например…
т.е. лучше создавать свой поток в драйвере при сохранении? какойнибудь там ZwCreateThread функцией?
PsCreateSystemThread
Обязательность или опционально сть обработчиков в NDIS_PROTOCOL_CHARACTERISTICS и NDIS_MINIPORT_CHARACTERISTICS описана в DDK, большинство из них нужны.
Сохранять в файл можно и из ядра (лучше из отдельного потока работающего на IRQL_PASSIVE_LEVEL, так как receive всегда приходит на IRQL_DISPATCH_LEVEL).
@kdub wrote:
Hi,
Is the PacketBuffer.m_Length property supposed to hold the length of the entire packet or does it contain the total length of the headers (ETH,IP,TCP)?Yes, this is entire packet length (headers and payload).
@kdub wrote:
I am filtering for only ETH_P_IP packets and the m_Length is always 54 which appears to be the header sizes (14,20,20). I am not able to get the payload data but I can get the IP and TCP header data successfully.
Believe or not, not all packets on the network are 54 bytes length and not all packets are TCP. In order to check if packet is TCP you have to check protocol field on the IP header which specifies next protocol.
@kdub wrote:
What is the correct way to get the length of the entire packet (ETH, IP, TCP,PAYLOAD,CHECKSUM) using the VB PassThru example?
Read Ethernet header, check if next protocol is IP. Read IP header, check if next protocol is TCP. If it is then read TCP header and follow up data if there is any.
You can’t affect cache manager behavior from user mode, however there is another way to do what you want. You can map each of 2000 files into the process memory (CreateFileMapping and MapViewOfFile), 20 megs should easily fit your process address space. Then read one byte from each page (each 4K) of each mapping, this will force system to bring all files into memory.
However, I would not force system to fetch all data from disk at once, but better postpone each fetch operation when it is really necessary.
@kdub wrote:
What is the difference between the NDISAPI.dll provided with the sample applications and the one provided with the Individual license?
There is no difference. DLL in the trial package is fully functional.
The IP and TCP headers are all contained in the same packet right?
Yes
What are the sizes of the IP header and TCP header?
IP header is usually 20 bytes length, but the actual length is specified in the header itself(http://www.erg.abdn.ac.uk/users/gorry/course/inet-pages/ip-packet.html). Same for TCP header (http://www.wtcs.org/snmp4tpc/images/TCP-Header.jpg) TCP header follows IP header, but IP can be used as transport for many other protocols, UDP, ICMP, GRE and etc…
Does the data/payload section always follow the TCP header?
If TCP packet contains data then yes they follow TCP header.
I am a newbie here and I was wondering if you could provide an example of how to read the data contents of a packet using visual basic syntax.
Regretfully I’m not a VB expert, but parsing Ethernet header is shown in the VB samples. You can parse follow up headers (IP, TCP/UDP) just on the same way.
Also is the data in the packet the same as it would be if I were to view the contents at the winsock level.
On WINSOCK level you work mostly with data streams (no packet headers), here you got packets with Ethernet, IP headers and etc… But packet payload contains the data you seen on winsock layer.
I want to get the source IP and Port and then view the data to determine whether to drop the packet or not, is that possible with WinPKFilter samples?
Yes, that is possible.
С HTTP вроде разобрался – имя хоста в исходящем пакете меняю, сумма сходится но какие то проблемы с ACK SEQ. Я так понял что при изменении длины пакета их надо менять. Как?
Если пакет увеличился в длинне (не выходя за границу Ethernet frame), то SEQ надо увеличить (а во входящем потоке уменьшить ACK). Изменение SEQ/ACK затем нужно тянуть до самого закрытия соединения. Аналогично поступаем при уменьшении длинны с точностью до наоборот.
IMHO проще перехватить DNS пакет и подменить в нем IP.
Any kernel module can run a thread in the context of the system process, what integrity do you mean here?
Hmm… And how does TI shape NATted connection!?…
TI developers know for sure. I would try to reverse engineer ICS implementation in Windows and get NAT table.
I would create an event and waited on this event (probably besides few other objects) in the thread routine instead of the KeDelayExecutionThread. Once I need to unload driver I would signal that event so the thread routine left waiting and called PsTerminateSystemThread. At the same time DriverUnload can wait for the thread to exit by waiting on the thread object.
Alternatively (less modifications in your code but not that nice) you can create some global variable and check its state in your Func:
void Func(PVOID a)
{
LARGE_INTEGER delay;
delay.QuadPart = SEC(1);
while(!KeDelayExecutionThread(KernelMode,0,&delay))
{
DbgPrint(">> thread message");
if(g_bLeaveThread)
break;
}
PsTerminateSystemThread();
}
In DriverUnload set the g_bLeaveThread to non-zero value and wait for the thread to exit (KeWaitForSingleObject on the thread object).
Each packet routed outside you intercept twice – first on the internal interface before NAT is applied and second on external interface after NAT is applied and vice versa for packets coming on the external interface. In theory you can match these packets (by IP address information + IP ID + TCP/UDP headers information) and build your own copy of NAT table but collisions are still possible especially if the router is heavily loaded.
I would recommend implementing NAT in the same module which implements shaper, this would save you lots time. NAT is relatively easy to implement (if you are not targeted to support complex protocols like H.323), an example this simple application has taken one day to write http://www.ntkernel.com/w&p.php?id=31
I am running Windows XP on my HP laptop. I installed MioNet which loads the driver NDISRD.SYS. Whenever this driver is loaded and I try to run my Cisco VPN client, the desktop locks up.
Any suggestions?Hmm, basically conflict here can be initiated by MioNet usage of NDISRD (which is a WinpkFilter driver) or by NDISRD directly. So here are some questions:
1) Do you run MioNet at the same time with Cisco VPN client?
2) Could you look at the version of NDISRD.SYS and post it here or e-mail to support(at)ntkernel.com?Also, if it is possible for you then could you please uninstall MioNet and install WinpkFilter package instead and check if problem pops up with WinpkFilter only?
Also, system just hanged? No chance on the crash dump?
Is there a way to unload the ndisrd.sys driver by using a DOS command?
This is not possible.
