The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I'm writing an NDIS LWF driver for Windows 10. This LWF will need to insert a 34-byte tag after the 802.3 MAC header. To do this, the driver changes the NDIS_RESTART_GENERAL_ATTRIBUTES .MtuSize to 1466 during the FilterRestart call. The driver also filters OID queries and changes the return values for OID_GEN_MAXIMUM_FRAME_SIZE from 1500 to 1466, as well as OID_GEN_MAXIMUM_TOTAL_SIZE from 1514 to 1480.
All of this works and I have verified that the IPV4 stack uses 1466 as its MTU through netsh->int->ipv4->show->int.
I tried to confirm the max packet length used by IPv4 after reducing the MTU. I did this by pinging a target with a large frame size (e.g., ping www.yahoo.com -l 16000) in order to fragment the ping payload over various max-MTU frames. However, I see that the fragmented packets are 1474 total bytes (1460 bytes for the IPV4 payload). I would have expected a packet length of 1480 with an IPV4 payload of 1466.
Does anybody know why IPV4 would reduce the MTU by 6 bytes in this way?
It looks like you're new here. If you want to get involved, click one of these buttons!
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|