ndis5, lookahead, and esp packets

When I pass an esp (ip proto 50) packet to windows with 134 bytes (eth header + 120 byte lookahead) in the first buffer and further bytes in an additional buffer, it seems that windows never receives it, or at least doesn’t respond to it. If the packet is less than the 120 byte lookahead then it seems to work just fine.

The exact same code path is used in a lot of other cases (big tcp packets etc) so I’m wondering if there is an additional rule for esp and multiple chained buffers in a packet. I can’t find any such thing documented though.

Does anyone have any ideas?

Thanks

James

Which version of Windows? Why is the “ndis5” token looming ominously in the subject line?

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of James Harper
Sent: Wednesday, February 27, 2013 1:48 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] ndis5, lookahead, and esp packets

When I pass an esp (ip proto 50) packet to windows with 134 bytes (eth header + 120 byte lookahead) in the first buffer and further bytes in an additional buffer, it seems that windows never receives it, or at least doesn’t respond to it. If the packet is less than the 120 byte lookahead then it seems to work just fine.

The exact same code path is used in a lot of other cases (big tcp packets etc) so I’m wondering if there is an additional rule for esp and multiple chained buffers in a packet. I can’t find any such thing documented though.

Does anyone have any ideas?

Thanks

James


NTDEV is sponsored by OSR

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

>

Which version of Windows? Why is the “ndis5” token looming ominously in
the subject line?

Win2003. I have been told by one user that the problem also exists in 2008(R2?) but haven’t confirmed this, and while the rules about splitting packets are fairly well defined for ndis6, ndis5 appears to be a little more vague and I keep finding little paragraphs of dos and don’ts around the place…

Thanks

James