Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

ndis5, lookahead, and esp packets

James_HarperJames_Harper Member Posts: 1,615
When I pass an esp (ip proto 50) packet to windows with 134 bytes (eth header + 120 byte lookahead) in the first buffer and further bytes in an additional buffer, it seems that windows never receives it, or at least doesn't respond to it. If the packet is less than the 120 byte lookahead then it seems to work just fine.

The exact same code path is used in a lot of other cases (big tcp packets etc) so I'm wondering if there is an additional rule for esp and multiple chained buffers in a packet. I can't find any such thing documented though.

Does anyone have any ideas?

Thanks

James

Comments

  • Jeffrey_Tippet_[MSFT]Jeffrey_Tippet_[MSFT] Member - All Emails Posts: 496
    Which version of Windows? Why is the "ndis5" token looming ominously in the subject line?

    -----Original Message-----
    From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of James Harper
    Sent: Wednesday, February 27, 2013 1:48 AM
    To: Windows System Software Devs Interest List
    Subject: [ntdev] ndis5, lookahead, and esp packets

    When I pass an esp (ip proto 50) packet to windows with 134 bytes (eth header + 120 byte lookahead) in the first buffer and further bytes in an additional buffer, it seems that windows never receives it, or at least doesn't respond to it. If the packet is less than the 120 byte lookahead then it seems to work just fine.

    The exact same code path is used in a lot of other cases (big tcp packets etc) so I'm wondering if there is an additional rule for esp and multiple chained buffers in a packet. I can't find any such thing documented though.

    Does anyone have any ideas?

    Thanks

    James

    ---
    NTDEV is sponsored by OSR

    OSR is HIRING!! See http://www.osr.com/careers

    For our schedule of WDF, WDM, debugging and other seminars visit:
    http://www.osr.com/seminars

    To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
  • James_HarperJames_Harper Member Posts: 1,615
    >
    > Which version of Windows? Why is the "ndis5" token looming ominously in
    > the subject line?
    >

    Win2003. I have been told by one user that the problem also exists in 2008(R2?) but haven't confirmed this, and while the rules about splitting packets are fairly well defined for ndis6, ndis5 appears to be a little more vague and I keep finding little paragraphs of dos and don'ts around the place...

    Thanks

    James
Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
Writing WDF Drivers 25 Feb 2019 OSR Seminar Space
Developing Minifilters 8 April 2019 OSR Seminar Space