Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

WFP callout gets out-of-order TCP packets

Save_me_O_GodSave_me_O_God Member Posts: 5

Any suggestions or ideas will be appreciated. I am willing to test out anything and provide extra information when needed.

I'm writing a VPN driver that (in the outbound direction)
 1. takes up the packets in FWPM_LAYER_OUTBOUND_IPPACKET_V4
 2. encrypts each packet (including the IP header)
 3. adds a UDP header and a new IP header that points to the VPN peer

The inbound direction does the reverse
 1. takes up the packets in FWPM_LAYER_INBOUND_IPPACKET_V4
 2. decrypts the data
 3. inject the decrypted packet back using FwpsInjectNetworkReceiveAsync0

Both directions work. While the downloading speed is perfect,
the uploading speed (outbound direction) gets extremely slow when the driver handles TCP-based file transfer, for example, SCP.

After some investigation, I realized that in the outbound direction, the packets come in an out-of-order manner.
 1. Whenever the callout gets called, I log the TCP sequence, smaller sequences might come later.
 2. WireShark on the receiving machine shows lots of out-of-order packets.
 *. This (out-of-order packets) slows down the uploading process.

As a last attempt, I've tested WFPSampler, and as it turns out,
its callout miraculously gets the packets in an ordered manner (in the outbound direction).
Thus, my issue doesn't appear in WFPSampler.

And here's the question:

  • is there anything I can do to make the packets ordered when they come to my callout?
  • or is it abnormal that my callout sees out-of-order packets?


Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Kernel Debugging 13-17 May 2024 Live, Online
Developing Minifilters 1-5 Apr 2024 Live, Online
Internals & Software Drivers 11-15 Mar 2024 Live, Online
Writing WDF Drivers 26 Feb - 1 Mar 2024 Live, Online