[Vadim Smirnov]

What environment do you use for the development? There is a C header file iphlp.h which has some sample protocol header definitions (IP header, TCP header, UDP header and etc…). If you are using Delphi then you can use the ones below:

TIPHeaderPtr = ^TIPHeader;

TIPHeader = packed record

VerLen: Byte;   //HL

TOS: Byte;

TotalLen: Word;

Identifer: Word;

FragOffsets: Word;

TTL: Byte;

Protocol: Byte;

CheckSum: Word;

SourceIp: DWORD;

DestIp: DWORD;

// Options: DWORD;

end;



TTCPHeaderPtr = ^TTCPHeader;

TTCPHeader = packed record

SourcePort:Word;

DestPort:Word;

SequenceNumber:DWord;

AcknowledgementNumber:DWord;

Offset:Byte; //only left 4 bits. Header length in 32-bit segments

Flags:Byte;

Window:Word;

Checksum:Word;  //includes speudo header instead of TCP header.

UrgentPointer:Word;

end;



pTCPData: PChar; 

And probably it makes sense for you to look at this topic:
http://ntkernel.com/forum/viewtopic.php?t=114

We are trying to provide as good support as we can 🙄

[Vadim Smirnov]

Is it possible to use both packet level and application level filtering with in the same program ie. inspect packet using winPKfilter then a LSP/TDI filter?

Yes, sure.

Does your company provide a application level filter?

We provide localhost monitor API, which is TDI filter for Windows NT/2000/XP/2003. LSP sample is avalaible as a part of MSDN. Simple TDI filter for Windows 9x can be found in the VTOOLSD samples (from Compuware).

[Vadim Smirnov]

WinpkFilter allows you implementing packet filtering technologies in both user or kernel mode (the one you choose depends from your expirience and requirements). But this is packet level filtering (it is not possible to determine application context on the NDIS level). For application level filtering you would need LSP or TDI filter.

[Vadim Smirnov]

Visual Basic samples for WinpkFilter 2.4 released. You can download it from WinpkFilter product homepage.

[Vadim Smirnov]

1. How can I use WinpkFilter for capturing packets from multiple adapters ?

You can start the dedicated thread for each network interface to capture and process packets from it, just like PassThru sample does. Another way is setting up events for each interface and using WaitForMultipleObjects.

2. Dose my WinpkFilter Appication NOT conflict with any other NDIS hooking drivers or WinpkFilter Applications ?

We can’t guarantee the compatibility with any other hooking drivers, but WinpkFilter is compatible with the majority of firewalls on the market. In order to avoid conflicts with other WinpkFilter applications you would need the custom build (with customized names for drivers and devices) of WinpkFilter drivers (free for the Developer license).

[Vadim Smirnov]

LSP is user mode solution, but TDI is kernel one. So, LSP is much more easier way. I don’t think that you should intercept clients who work with TDI directly, so probably LSP fits you.

[Vadim Smirnov]

Is it possible to use virtual network interface? Or even virtual NIC is not allowed? In the last case you have the only choice – TDI filter driver.

[Vadim Smirnov]

Just follow the online order link for the WinpkFilter Source Code (click Order Now) available at: http://www.ntkernel.com/products/winpkfilter.shtml

Here the exact link for your convinience:

http://secure.emetrix.com/order/product.asp?PID=38895814

If you have any problems with it please contact [email protected].

Thanks for your interest in WinpkFilter.

[Vadim Smirnov]

I’m sorry, I have not ready function for this, but you can use GetIpForwardTable for retrieving the IP routing table. Usually the deafault gateway interface (0.0.0.0 mask 0.0.0.0 is the Internet one).

[Vadim Smirnov]

Thank you for your interest. NT Kernel Firewall 2.0 development was not stopped, but this is a low priority project for us (caused by very low level of sales).

However, taking into account your interest in this product we could release the intermediate version of it (1.3) with the fetures you would like to have first. We really appreciate your ideas and interest.

[Vadim Smirnov]

We ordered it exactly 7 days ago and didn’t get anything by email
or else. I mailed the order # to support@.

The download information was just resent to the address specified in the order details. Please check if it is correct. There is also a possibility that notification was killed by one of the spam filters along the way. In this case please change the e-mail in the order details.

OK, what information do you need ?

Where do you actually set up the breakpoints?

[Vadim Smirnov]

Localhost API helper driver intercepts TDI level of TCP/IP stack and you must be carefull when working with it. It is difficult to say how debugger affects system functionality in this case, but if you provide more information may be I would be able to advise.

I am still using the Demo API version (waiting for the CD
to arrive).

If you have ordered Localhost API then you should receive the download link for the full version. If you have not received it then please e-mail [email protected].

[Vadim Smirnov]

There is no difference on the NDIS level between network adapter connected to the corporate network and internet adapter connected to the Internet. However, you can use IP HELPER API to query routing table, usually the default gateway interface (route 0.0.0.0 mask 0.0.0.0) is the Internet one. IP Helper API can be also used for enumeratimg active connections.

[Vadim Smirnov]

Does this driver works with token rings?

No, token ring networks are not supported. Actually, I have not heard about token ring networks for years. Do you really need to support this out-of-date standard?

[Vadim Smirnov]

Does NDISRD.SYS only bind itself to interfaces with TCP/IP enabled?

Yes. For your needs you’d better use protocol driver (Winpcap, PCAUSA RAWETHER or etc.).

[Author]

Posts