The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.
Check out The OSR Learning Library at: https://www.osr.com/osr-learning-library/
I'm developing a network monitor (without modify) driver base on WFP callout model. Print output simple TCP/UDP infors: pid, data send/recv length anytime send() called.
on TCP connection, i can get those infors by use flow context from FWPM_LAYER_ALE_FLOW_ESTABLISHED_V* to FWPM_LAYER_STREAM_V*.
Then, get data length by parsing FWPS_STREAM_CALLOUT_IO_PACKET at stream layer.
on UDP connection, i also use flow context, from FWPM_LAYER_ALE_FLOW_ESTABLISHED_V* to FWPM_LAYER_DATAGRAM_DATA_V*.
But, at the FWPM_LAYER_DATAGRAM_DATA_V*, i can only parsing NET_BUFFER_LIST instead FWPS_STREAM_CALLOUT_IO_PACKET like TCP connection.
my question (for UDP connection):
Can i get exactly data length (send/recv) by the sum of DataLength member value in all NET_BUFFER struct in NET_BUFFER_LIST?
|Upcoming OSR Seminars|
|OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!||Kernel Debugging||30 Mar 2020||OSR Seminar Space|
|Developing Minifilters||15 Jun 2020||LIVE ONLINE|
|Writing WDF Drivers||22 June 2020||LIVE ONLINE|
|Internals & Software Drivers||28 Sept 2020||Dulles, VA|