Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results

Home NTDEV
Before Posting...
Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging


The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.


Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/


Windows 10: IPV4 MTU Handling If LWF Modifies OID_GEN_MAXIMUM_FRAME_SIZE/OID_GEN_MAXIMUM_TOTAL_SIZE

SoquelDudeSoquelDude Member Posts: 68

I'm writing an NDIS LWF driver for Windows 10. This LWF will need to insert a 34-byte tag after the 802.3 MAC header. To do this, the driver changes the NDIS_RESTART_GENERAL_ATTRIBUTES .MtuSize to 1466 during the FilterRestart call. The driver also filters OID queries and changes the return values for OID_GEN_MAXIMUM_FRAME_SIZE from 1500 to 1466, as well as OID_GEN_MAXIMUM_TOTAL_SIZE from 1514 to 1480.

All of this works and I have verified that the IPV4 stack uses 1466 as its MTU through netsh->int->ipv4->show->int.

I tried to confirm the max packet length used by IPv4 after reducing the MTU. I did this by pinging a target with a large frame size (e.g., ping www.yahoo.com -l 16000) in order to fragment the ping payload over various max-MTU frames. However, I see that the fragmented packets are 1474 total bytes (1460 bytes for the IPV4 payload). I would have expected a packet length of 1480 with an IPV4 payload of 1466.

Does anybody know why IPV4 would reduce the MTU by 6 bytes in this way?

Thanks!

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 30 Mar 2020 OSR Seminar Space
Developing Minifilters 15 Jun 2020 LIVE ONLINE
Writing WDF Drivers 22 June 2020 LIVE ONLINE
Internals & Software Drivers 28 Sept 2020 Dulles, VA