How to know ipv4 or ipv6 from NDIS packet with out Ethernet header ?

NTDEV
1

I am getting packet from filter SendNetBufferLists function () , i want to filter the packet for checking the IP headers .

when i use NdisMedium802_3 medium , getting Ethernet header ( Ethernet frames ) . so i can do the filter action like :

PPF_ETHERNET_HEADER pEthHeader = (PPF_ETHERNET_HEADER) pBuffer;

filter.nEthProto = pEthHeader->nProto;

ISystem::MCopyMemory(&filter.aSrcMac, &pEthHeader->aSrcMac, sizeof(ETH_MAC_ADDRESS));

ISystem::MCopyMemory(&filter.aDstMac, &pEthHeader->aDstMac, sizeof(ETH_MAC_ADDRESS));

if (filter.nEthProto == ETH_PROTO_IPV4) {

PPF_IPV4_HEADER pIpHeader = (PPF_IPV4_HEADER) (pBuffer + sizeof(PF_ETHERNET_HEADER));

/* IPV4 operations */

}

else if (filter.nEthProto == ETH_PROTO_IPV6)
{

PPF_IPV6_HEADER pIpHeader = (PPF_IPV6_HEADER) (pBuffer + sizeof(PF_ETHERNET_HEADER));

/* IPV6 operations */
}

This is working fine .

Now i am attaching NdisMediumWirelessWan / NdisMediumIP adapter . I am getting packet with out Ethernet header ( RAW IP frames ) .

so how can i check whether the buffer contain ipv4 or ipv6 protocol with out Ethernet header ?

2

> so how can i check whether the buffer contain ipv4 or ipv6 protocol with out Ethernet header ?

Well,this one seems to be pretty daft even by your standards…

Anton Bassov

3

vinay kp wrote:

so how can i check whether the buffer contain ipv4 or ipv6
protocol with out Ethernet header ?

Here’s my question. What is “ISystem::MCopyMemory”? Is it from a framework that vinay is using?

The only relevant hit for it on Google is a “suspiciously similar” article on Stackoverflow:

http://stackoverflow.com/questions/37772273/how-to-know-ipv4-or-ipv6-from-ndis-packet-buffer

As for vinay’s actual question, well, I have to agree that if he can’t make this determination on his own, well, he’s likely “wholly unequipped” to deliver something in this space… but that’s “hardly new” information, at this point…

4

> well, he’s likely “wholly unequipped” to deliver something in this space… but that’s

“hardly new” information, at this point…

Well, these days he seems to be sort of snubbed even by " don’t forget we were all inexperienced once" community. I know it sounds incredible, but his levels of obtuseness seem to be sufficient to eventually turn away even these folks - as I can see, they seem to have lost any hopes with him, so that the vast majority of the threads that he starts get completely ignored these days…

Anton Bassov

5

I believe the NBL has the protocol type specified in the metadata.

Sent from my Windows 10 phone

6

I don’t know why all of you blaming me . Is this question is bad ? I am a beginner in NDIS . I want to learn about that . So that’s why I posted questions . 6+ month I am running behind a question , when I get any clues I am posting here to clarify my doubts .

Now also I am checking same thing . Tell me if my understanding is wrong .

1 . Mobile broadband device sending RAW up frames with out Ethernet header .

2 . In my code I am filtering packets using my filter funtion using Ethernet header .

  1. When I get raw IP , my function us failing to fetch whether the packet is ipv4 or ipv6 .

  2. Now I want to support this type of packet .

So any idea about these ? Or my understanding is wrong ?

7

xxxxx@gmail.com wrote:

I don’t know why all of you blaming me . Is this question is bad ? I am a beginner in NDIS . I want to learn about that . So that’s why I posted questions . 6+ month I am running behind a question , when I get any clues I am posting here to clarify my doubts .

My advice is to let the negative comments roll off without worrying
about them very much. You have dived head-first into a complicated area
without sufficient training. Unfortunately, you have developed a
reputation for asking questions that are either vague or simplistic, and
that reputation will carry with you for a very long time.

Now also I am checking same thing . Tell me if my understanding is wrong .

  1. Mobile broadband device sending RAW up frames with out Ethernet header .
  2. In my code I am filtering packets using my filter funtion using Ethernet header .
  3. When I get raw IP , my function us failing to fetch whether the packet is ipv4 or ipv6 .
  4. Now I want to support this type of packet .

So any idea about these ? Or my understanding is wrong ?

Is it not the case that the first four bits of every IP packet give you
the version number?

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.

8

Have you looked at the flags in the NBL header?

NDIS_NBL_FLAGS_IS_IPV4
All of the Ethernet frames in this NET_BUFFER_LIST structure are IPv4 frames. If this flag is set, the header-data split provider must not set the NDIS_NBL_FLAGS_IS_IPV6 flag.
NDIS_NBL_FLAGS_IS_IPV6
All of the Ethernet frames in this NET_BUFFER_LIST structure are IPv6 frames. If this flag is set, the header-data split provider must not set the NDIS_NBL_FLAGS_IS_IPV4 flag.
If you have, then you should tell us that. If you have not, then you should really spend some time just reading the documentation.

This section titled “MB Raw IP Packet Processing Support” pretty much has the answer:

https://msdn.microsoft.com/en-us/library/windows/hardware/ff559110(v=vs.85).aspx

As Mr. Roberts so charitably points out, you should just ignore the negative comments to the extent that they are neither helpful nor on topic. However, you really should not build a reputation here as someone whom does not seem to be willing to do the most basic of self education (e.g. RTFM) before asking questions that are easily answered with a Google (heck, even Bing) search and/or a reading of the table of contents and picking the right topic from the WDK documentation.

Good Luck. You will need it.
Dave Cattley

9

I didn’t set NDIS_NBL_FLAGS_IS_IPV4 flag in Netbufferlist . Should i set in miniport send buffer list or return buffer list ? or filter send/receive function ?