[Vadim Smirnov]

Can you share an example (C/C++) for that case, suppose the new size (changed) always less than or equals MAX_ETHER_FRAME.

Sorry, at the moment we don’t have sample which modifies TCP data length in the packet. Implementing this kind of modification is a bit more complex that just changing few bytes in the packet without changing its length. I would recommend reading some good overview of TCP protocol before trying to implement this. In two words you have to track/alter sequence and acknowledgement fields in the packets. An example, you change “sex sex” in the incoming packet with «foo”, after this modification TCP data length of the packet is reduced for 4 bytes, so you should also modify sequence number in the TCP header by reducing it to 4. This SINGLE modification affects the whole TCP connection and you should also do the following:

1) For all other incoming packets associated with this connection you should also reduce the sequence for these 4 bytes.
2) For the outgoing packets associated with this connection you have to increment an acknowledgement number for those 4 bytes.

If you do more modifications then you should recalculate sequence/acknowledgement numbers shift.

[Vadim Smirnov]

ndisapi.dll binary in the WinpkFilter demo package was fixed. Thanks for reporting this problem.

[Vadim Smirnov]

Yes, you are right; there are problems with using the ndisapi.dll binary included within the WinplFilter package. The problem was caused by moving the NDISAPI project from one building environment to another so the routines exported through the DEF file were not exported anymore (this binary also is not possible to use with Delphi). We appreciate you report, WinpkFilter packages with fixed ndisapi.dll binary will be available for download in the next few days.

Fixed binary also available for download from the following link http://www.ntkernel.com/downloads/ndisapi.zip

Since WinpkFilter 3.0 we provide the complete source code for the ndisapi.dll in the freely available packages because of different building environments you may have to use. So, you can modify/port/rebuild the ndisapi.dll or even integrate it into your application.

Some others functions doesnt respect the functions declarations presented in the Help.

Could you please provide the details?

[Vadim Smirnov]

Well, DomainSuffixTool.exe is not relative to NeT Firewall. I guess that you already uninstalled NeT Firewall, and DomainSuffixTool.exe belongs to some other software you had tried and also uninstalled but not completely. I’d advise to check autorun and registry keys associated with application auto start up in order to detect the exact reason.

[Vadim Smirnov]

Blocked packets in the log were blocked by TCP stateful inspection module (these packets could be retransmitted/duplicated packets or corrupted during transmission, these could be also malicious packets but I don’t think this is the case).

You can disable TCP statefull inspection in the firewall options, but I would not recommend it.

[Vadim Smirnov]

Since Sygate firewall discontinued by Symantec it won’t cause compatibility problems anymore.

http://www.geek.com/news/geeknews/2005Nov/gee20051130033532.htm

[Vadim Smirnov]

pIpHeader = (iphdr_ptr)(pPacketBuffer->m_IBuffer + ETHER_HEADER_LENGTH);
pTcpHeader = (tcphdr_ptr)(((PUCHAR)pIpHeader) + sizeof(DWORD)*pIpHeader->ip_hl);

[Vadim Smirnov]

pIPHeader = (iphdr*)PacketBuffer.m_IBuffer+14;

Typecasting has a higher priority than operator + above. You have to change it to:

pIPHeader = (iphdr*)PacketBuffer.m_IBuffer[14];

or

pIPHeader = (iphdr*)(PacketBuffer.m_IBuffer+14);

[Vadim Smirnov]

Can I limit bandwidth using winpkfltr for each ip/source combination?

Yes

If so, Please give me some directions on how to do this?

The basic idea is pretty simple. One possible realization is the following. Create a queue and put all packets into. Also create a periodic timer and each time when timer fires calculate time passed since last timer. Then claculate the amount of data you can allow to pass for the given time and process as many packets from the queue as it fits into clculated amount of data.

[Vadim Smirnov]

Can I use Winpkfltr to look at the ip header and make a decision on to drop/forward the packet?

Yes. You can take PassThru sample as a base. If you decide to drop the packet just don’t reinject it into the stack (by calling SendPacketToAdapter or SendPacketToMstcp).

This function should be able to drop or forward the packet based on some criteria. But here is the problem:
I dont want to drop all packets going to certain ip and port. For the same ip and port, I only want to drop say 10% of the packets and for some other ip/port, drop 20% of the packets.

You can use kind of random generator, like C run time rand() routine.

An example, 20% chance of drop may look like:
if (rand() < RAND_MAX/5) bDrop = TRUE;

[Vadim Smirnov]

I am trying to compile PAssThru in cbuilder folder.

I use:
bcc32.exe PassThru.cpp

Hmm, I would start Borland C++ Builder, select File->Open Project, browse to PassThru.bpr and open it. After this I would click Project->Build PassThru.

it gives me many unrsolved external sybol errors. I understand that these are caused by the linker and I probably have to link it with ndisapi.dll, but I dont know how to do this.

Actually, you have to link to ndisapi.lib (stub library for ndisapi.dll).

[Vadim Smirnov]

As it is stated on VirtNet page it is just dummy network interface which does not do anything special itself (similar to MS loopback adapter, but supports all Windows operating systems). However, when used in combination with WinpkFilter you can build various virtual network environments over it.

WinpkFilter can be used for implementing two major tasks:

1) To indicate packets from the name of VirtNet to TCP/IP stack.
2) To intercept packets sent by TCP/IP stack to VirtNet network interface.

You can create pure virtual network environment or bridge it to the real network or …. Actually, it depends only from you requirements.

[Vadim Smirnov]

So, Net firewall is full functional also if no one is logged on the system.
It’s right?

Right

How can I see log of Firewall activity before I log on?

Log is not collected if firewall console (MMC snap-in) is not loaded, so in the current version there is no way to look through packets processed before logon.

[Vadim Smirnov]

NTKernelService stats dirung system start up, load latest firewall configuration into the driver and exits. So the situation you have expirienced is normal, this service should not be running, all the packet filtering functionality implemented in the kernel mode driver. Service is only responsible for configuring it.

[Vadim Smirnov]

If I add a rule allowing external access to one of those IP’s, all the others get accessable too. Why is that?

It should not be, probably the rule you create is too common and covers more than one IP.

Could someone please list a standard ruleset for allowing all traffic to port 80 on the server only. I know it’s very basic but it would be great to make sure I did it right.

Allow, TCP, Source IP: Any, Source Port: Any, Destination IP:[IP address your WWW server is bound to], Destination Port:80 Bidirectional.

Also set the security level to high.

I found a few bugs playing about. Are you interested in fixing then if i detail the issues?

Sure, if you find any bugs we would appreciate reporting about…

[Author]

Posts