Hi everyone
I am writing a Packet Filter in Windows 2K using DDK
2000.I used the ExtendingPassthru Sample to build my
driver and test it on the virtual marchine(VMWare).It
worked very well but when I tried on the real
machine,the problem occurred:
The driver could bind to the NIC below but when I
called
Packet = NdisGetReceivedPacket(pAdapt->BindingHandle,
MacReceiveContext);
the Packet ALWAYS is NULL.Why is that?
Even Packet is NULL,the real packet to the computer
still existed and passed through easily.
If I return NDIS_PACKET_FAILURE right after that call
then the real packet was dropped(but Packet still
NULL)?
Could anyone tell me what happen?How can I get the
real packet to filter it(drop or pass it)?
Thank you very much.
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/
This will happen if the lower miniport indicates packets with the
old-style NdisMEthIndicateReceive indication.
Bryan S. Burgin
xxxxx@microsoft.com
This posting is provided “AS IS” with no warranties, and confers no
rights.
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Linh Nguyen
Sent: Friday, December 12, 2003 2:55 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] A problem about IM Driver
Hi everyone
I am writing a Packet Filter in Windows 2K using DDK
2000.I used the ExtendingPassthru Sample to build my
driver and test it on the virtual marchine(VMWare).It
worked very well but when I tried on the real
machine,the problem occurred:
The driver could bind to the NIC below but when I
called
Packet = NdisGetReceivedPacket(pAdapt->BindingHandle,
MacReceiveContext);
the Packet ALWAYS is NULL.Why is that?
Even Packet is NULL,the real packet to the computer
still existed and passed through easily.
If I return NDIS_PACKET_FAILURE right after that call
then the real packet was dropped(but Packet still
NULL)?
Could anyone tell me what happen?How can I get the
real packet to filter it(drop or pass it)?
Thank you very much.
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
You are currently subscribed to ntdev as: xxxxx@microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
So what should I do to make it right(i.e get the real
packet?)
— Bryan Burgin wrote:
>
>
> This will happen if the lower miniport indicates
> packets with the
> old-style NdisMEthIndicateReceive indication.
>
> Bryan S. Burgin
> xxxxx@microsoft.com
>
> This posting is provided “AS IS” with no warranties,
> and confers no
> rights.
>
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf
> Of Linh Nguyen
> Sent: Friday, December 12, 2003 2:55 PM
> To: Windows System Software Devs Interest List
> Subject: [ntdev] A problem about IM Driver
>
> Hi everyone
> I am writing a Packet Filter in Windows 2K using DDK
> 2000.I used the ExtendingPassthru Sample to build my
> driver and test it on the virtual
> marchine(VMWare).It
> worked very well but when I tried on the real
> machine,the problem occurred:
> The driver could bind to the NIC below but when I
> called
> Packet =
> NdisGetReceivedPacket(pAdapt->BindingHandle,
> MacReceiveContext);
> the Packet ALWAYS is NULL.Why is that?
> Even Packet is NULL,the real packet to the computer
> still existed and passed through easily.
> If I return NDIS_PACKET_FAILURE right after that
> call
> then the real packet was dropped(but Packet still
> NULL)?
> Could anyone tell me what happen?How can I get the
> real packet to filter it(drop or pass it)?
> Thank you very much.
>
>
> Do you Yahoo!?
> New Yahoo! Photos - easier uploading and sharing.
> http://photos.yahoo.com/
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@microsoft.com
> To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/
Real packet isn’t available as NDIS_PACKET. You have to process packet data
old way using header and lookahead buffers passed as parameters to
ProtocolReceive. In the worst case you have to ask below miniport for the
rest of data using NdisTransferData function.
Maybe you should read NDIS docs before continuing.
Best regards,
Michal Vodicka
STMicroelectronics Design and Application s.r.o.
[michal.vodicka@st.com, http:://www.st.com]
From: xxxxx@yahoo.com[SMTP:xxxxx@yahoo.com]
Reply To: xxxxx@lists.osr.com
Sent: Saturday, December 13, 2003 2:23 AM
To: xxxxx@lists.osr.com
Subject: [ntdev] RE: A problem about IM Driver
So what should I do to make it right(i.e get the real
packet?)
— Bryan Burgin wrote:
> >
> >
> > This will happen if the lower miniport indicates
> > packets with the
> > old-style NdisMEthIndicateReceive indication.
> >
> > Bryan S. Burgin
> > xxxxx@microsoft.com
> >
> > This posting is provided “AS IS” with no warranties,
> > and confers no
> > rights.
> >
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf
> > Of Linh Nguyen
> > Sent: Friday, December 12, 2003 2:55 PM
> > To: Windows System Software Devs Interest List
> > Subject: [ntdev] A problem about IM Driver
> >
> > Hi everyone
> > I am writing a Packet Filter in Windows 2K using DDK
> > 2000.I used the ExtendingPassthru Sample to build my
> > driver and test it on the virtual
> > marchine(VMWare).It
> > worked very well but when I tried on the real
> > machine,the problem occurred:
> > The driver could bind to the NIC below but when I
> > called
> > Packet =
> > NdisGetReceivedPacket(pAdapt->BindingHandle,
> > MacReceiveContext);
> > the Packet ALWAYS is NULL.Why is that?
> > Even Packet is NULL,the real packet to the computer
> > still existed and passed through easily.
> > If I return NDIS_PACKET_FAILURE right after that
> > call
> > then the real packet was dropped(but Packet still
> > NULL)?
> > Could anyone tell me what happen?How can I get the
> > real packet to filter it(drop or pass it)?
> > Thank you very much.
> >
> >
> > Do you Yahoo!?
> > New Yahoo! Photos - easier uploading and sharing.
> > http://photos.yahoo.com/
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@microsoft.com
> > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
>
> Do you Yahoo!?
> New Yahoo! Photos - easier uploading and sharing.
> http://photos.yahoo.com/
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: michal.vodicka@st.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
Thanks.But could you explain this to me:
In PtReceive,I used the call like below and I think if
the pointer Packet == NULL then the function didn’t
receive the packet and the packet just silently pass
through the filter.That was true because I could ping
and receive the packet.This means the function
PtReceive didn’t do anything.But when I intermediete
return after calling Packet =
NdisGetReceivedPacket(pAdapt->
BindingHandle,MacReceiveContext);
then the packet was lost even the pointer Packet was
NULL?
— Michal Vodicka
wrote:
> Real packet isn’t available as NDIS_PACKET. You have
> to process packet data
> old way using header and lookahead buffers passed as
> parameters to
> ProtocolReceive. In the worst case you have to ask
> below miniport for the
> rest of data using NdisTransferData function.
>
> Maybe you should read NDIS docs before continuing.
>
> Best regards,
>
> Michal Vodicka
> STMicroelectronics Design and Application s.r.o.
> [michal.vodicka@st.com, http:://www.st.com]
>
> > ----------
> > From:
> xxxxx@yahoo.com[SMTP:xxxxx@yahoo.com]
> > Reply To: xxxxx@lists.osr.com
> > Sent: Saturday, December 13, 2003 2:23 AM
> > To: xxxxx@lists.osr.com
> > Subject: [ntdev] RE: A problem about IM Driver
> >
> > So what should I do to make it right(i.e get the
> real
> > packet?)
> >
> > — Bryan Burgin wrote:
> > >
> > >
> > > This will happen if the lower miniport indicates
> > > packets with the
> > > old-style NdisMEthIndicateReceive indication.
> > >
> > > Bryan S. Burgin
> > > xxxxx@microsoft.com
> > >
> > > This posting is provided “AS IS” with no
> warranties,
> > > and confers no
> > > rights.
> > >
> > >
> > > -----Original Message-----
> > > From: xxxxx@lists.osr.com
> > > [mailto:xxxxx@lists.osr.com] On
> Behalf
> > > Of Linh Nguyen
> > > Sent: Friday, December 12, 2003 2:55 PM
> > > To: Windows System Software Devs Interest List
> > > Subject: [ntdev] A problem about IM Driver
> > >
> > > Hi everyone
> > > I am writing a Packet Filter in Windows 2K using
> DDK
> > > 2000.I used the ExtendingPassthru Sample to
> build my
> > > driver and test it on the virtual
> > > marchine(VMWare).It
> > > worked very well but when I tried on the real
> > > machine,the problem occurred:
> > > The driver could bind to the NIC below but when
> I
> > > called
> > > Packet =
> > > NdisGetReceivedPacket(pAdapt->BindingHandle,
> > > MacReceiveContext);
> > > the Packet ALWAYS is NULL.Why is that?
> > > Even Packet is NULL,the real packet to the
> computer
> > > still existed and passed through easily.
> > > If I return NDIS_PACKET_FAILURE right after that
> > > call
> > > then the real packet was dropped(but Packet
> still
> > > NULL)?
> > > Could anyone tell me what happen?How can I get
> the
> > > real packet to filter it(drop or pass it)?
> > > Thank you very much.
> > >
> > >
> > > Do you Yahoo!?
> > > New Yahoo! Photos - easier uploading and
> sharing.
> > > http://photos.yahoo.com/
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > > xxxxx@microsoft.com
> > > To unsubscribe send a blank email to
> > > xxxxx@lists.osr.com
> > >
> > >
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > > xxxxx@yahoo.com
> > > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> >
> >
> >
> > Do you Yahoo!?
> > New Yahoo! Photos - easier uploading and sharing.
> > http://photos.yahoo.com/
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> michal.vodicka@st.com
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
> >
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as:
> xxxxx@yahoo.com
> To unsubscribe send a blank email to
xxxxx@lists.osr.com
__________________________________
Do you Yahoo!?
New Yahoo! Photos - easier uploading and sharing.
http://photos.yahoo.com/
PtReceive can be called due to:
- lower miniport using old-style receive - which means
NdisGetReceivedPacket() == NULL
- lower miniport using modern NdisMIndicateReceivePacket, but with
NDIS_STATUS_RESOURCES, in this case, NdisGetReceivedPacket() != NULL.
In the second case, you must allocate the packet from scratch, copy all
data there by NdisTransferData, copy all OOB per-packet data from the
NdisGetReceivedPacket, and indicate it up.
The new-fashion (XP+) packet stacking can also help.
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com
----- Original Message -----
From: “Linh Nguyen”
To: “Windows System Software Devs Interest List”
Sent: Sunday, December 14, 2003 5:09 AM
Subject: [ntdev] RE: A problem about IM Driver
> Thanks.But could you explain this to me:
> In PtReceive,I used the call like below and I think if
> the pointer Packet == NULL then the function didn’t
> receive the packet and the packet just silently pass
> through the filter.That was true because I could ping
> and receive the packet.This means the function
> PtReceive didn’t do anything.But when I intermediete
> return after calling Packet =
> NdisGetReceivedPacket(pAdapt->
> BindingHandle,MacReceiveContext);
> then the packet was lost even the pointer Packet was
> NULL?
>
> — Michal Vodicka
> wrote:
> > Real packet isn’t available as NDIS_PACKET. You have
> > to process packet data
> > old way using header and lookahead buffers passed as
> > parameters to
> > ProtocolReceive. In the worst case you have to ask
> > below miniport for the
> > rest of data using NdisTransferData function.
> >
> > Maybe you should read NDIS docs before continuing.
> >
> > Best regards,
> >
> > Michal Vodicka
> > STMicroelectronics Design and Application s.r.o.
> > [michal.vodicka@st.com, http:://www.st.com]
> >
> > > ----------
> > > From:
> > xxxxx@yahoo.com[SMTP:xxxxx@yahoo.com]
> > > Reply To: xxxxx@lists.osr.com
> > > Sent: Saturday, December 13, 2003 2:23 AM
> > > To: xxxxx@lists.osr.com
> > > Subject: [ntdev] RE: A problem about IM Driver
> > >
> > > So what should I do to make it right(i.e get the
> > real
> > > packet?)
> > >
> > > — Bryan Burgin wrote:
> > > >
> > > >
> > > > This will happen if the lower miniport indicates
> > > > packets with the
> > > > old-style NdisMEthIndicateReceive indication.
> > > >
> > > > Bryan S. Burgin
> > > > xxxxx@microsoft.com
> > > >
> > > > This posting is provided “AS IS” with no
> > warranties,
> > > > and confers no
> > > > rights.
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: xxxxx@lists.osr.com
> > > > [mailto:xxxxx@lists.osr.com] On
> > Behalf
> > > > Of Linh Nguyen
> > > > Sent: Friday, December 12, 2003 2:55 PM
> > > > To: Windows System Software Devs Interest List
> > > > Subject: [ntdev] A problem about IM Driver
> > > >
> > > > Hi everyone
> > > > I am writing a Packet Filter in Windows 2K using
> > DDK
> > > > 2000.I used the ExtendingPassthru Sample to
> > build my
> > > > driver and test it on the virtual
> > > > marchine(VMWare).It
> > > > worked very well but when I tried on the real
> > > > machine,the problem occurred:
> > > > The driver could bind to the NIC below but when
> > I
> > > > called
> > > > Packet =
> > > > NdisGetReceivedPacket(pAdapt->BindingHandle,
> > > > MacReceiveContext);
> > > > the Packet ALWAYS is NULL.Why is that?
> > > > Even Packet is NULL,the real packet to the
> > computer
> > > > still existed and passed through easily.
> > > > If I return NDIS_PACKET_FAILURE right after that
> > > > call
> > > > then the real packet was dropped(but Packet
> > still
> > > > NULL)?
> > > > Could anyone tell me what happen?How can I get
> > the
> > > > real packet to filter it(drop or pass it)?
> > > > Thank you very much.
> > > >
> > > >
> > > > Do you Yahoo!?
> > > > New Yahoo! Photos - easier uploading and
> > sharing.
> > > > http://photos.yahoo.com/
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ at
> > > > http://www.osronline.com/article.cfm?id=256
> > > >
> > > > You are currently subscribed to ntdev as:
> > > > xxxxx@microsoft.com
> > > > To unsubscribe send a blank email to
> > > > xxxxx@lists.osr.com
> > > >
> > > >
> > > >
> > > > —
> > > > Questions? First check the Kernel Driver FAQ at
> > > > http://www.osronline.com/article.cfm?id=256
> > > >
> > > > You are currently subscribed to ntdev as:
> > > > xxxxx@yahoo.com
> > > > To unsubscribe send a blank email to
> > > xxxxx@lists.osr.com
> > >
> > >
> > >
> > > Do you Yahoo!?
> > > New Yahoo! Photos - easier uploading and sharing.
> > > http://photos.yahoo.com/
> > >
> > > —
> > > Questions? First check the Kernel Driver FAQ at
> > > http://www.osronline.com/article.cfm?id=256
> > >
> > > You are currently subscribed to ntdev as:
> > michal.vodicka@st.com
> > > To unsubscribe send a blank email to
> > xxxxx@lists.osr.com
> > >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as:
> > xxxxx@yahoo.com
> > To unsubscribe send a blank email to
> xxxxx@lists.osr.com
>
>
> __________________________________
> Do you Yahoo!?
> New Yahoo! Photos - easier uploading and sharing.
> http://photos.yahoo.com/
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
In ProtocolReceive NEVER assume that NdisGetReceivedPacket will fetch
anything other then NULL. You must write your code to accomodate that case
where NdisGetReceivedPacket does not return a packet descriptor.
If it does return a packet descriptor, make sure that you understand that
the packet descriptor is only valid in the context of your ProtocolReceive
handler. You cannot “claim” the packet (like you can in
ProtocolReceivePacket). This means that you cannot call
NdisMIndicateReceivePacket with the packet descriptor returned by
NdisGetReceivedPacket.
The DDK documents should be clear on this.
Good luck,
Thomas F. Divine
www.rawether.net
“Linh Nguyen” wrote in message news:xxxxx@ntdev…
>
> Thanks.But could you explain this to me:
> In PtReceive,I used the call like below and I think if
> the pointer Packet == NULL then the function didn’t
> receive the packet and the packet just silently pass
> through the filter.That was true because I could ping
> and receive the packet.This means the function
> PtReceive didn’t do anything.But when I intermediete
> return after calling Packet =
> NdisGetReceivedPacket(pAdapt->
> BindingHandle,MacReceiveContext);
> then the packet was lost even the pointer Packet was
> NULL?
>
> — Michal Vodicka
> wrote:
> > Real packet isn’t available as NDIS_PACKET. You have
> > to process packet data
> > old way using header and lookahead buffers passed as
> > parameters to
> > ProtocolReceive. In the worst case you have to ask
> > below miniport for the
> > rest of data using NdisTransferData function.
> >
> > Maybe you should read NDIS docs before continuing.
> >
> > Best regards,
> >
> > Michal Vodicka
> > STMicroelectronics Design and Application s.r.o.
> > [michal.vodicka@st.com, http:://www.st.com]
> >
> > > ----------
> > > From:
> > xxxxx@yahoo.com[SMTP:xxxxx@yahoo.com]
> > > Reply To: xxxxx@lists.osr.com
> > > Sent: Saturday, December 13, 2003 2:23 AM
> > > To: xxxxx@lists.osr.com
> > > Subject: [ntdev] RE: A problem about IM Driver
> > >
> > > So what should I do to make it right(i.e get the
> > real
> > > packet?)
> > >
> > > — Bryan Burgin wrote:
> > > >
> > > >
> > > > This will happen if the lower miniport indicates
> > > > packets with the
> > > > old-style NdisMEthIndicateReceive indication.
> > > >
> > > > Bryan S. Burgin
> > > > xxxxx@microsoft.com
> > > >
> > > > This posting is provided “AS IS” with no
> > warranties,
> > > > and confers no
> > > > rights.
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: xxxxx@lists.osr.com
> > > > [mailto:xxxxx@lists.osr.com] On
> > Behalf
> > > > Of Linh Nguyen
> > > > Sent: Friday, December 12, 2003 2:55 PM
> > > > To: Windows System Software Devs Interest List
> > > > Subject: [ntdev] A problem about IM Driver
> > > >
> > > > Hi everyone
> > > > I am writing a Packet Filter in Windows 2K using
> > DDK
> > > > 2000.I used the ExtendingPassthru Sample to
> > build my
> > > > driver and test it on the virtual
> > > > marchine(VMWare).It
> > > > worked very well but when I tried on the real
> > > > machine,the problem occurred:
> > > > The driver could bind to the NIC below but when
> > I
> > > > called
> > > > Packet =
> > > > NdisGetReceivedPacket(pAdapt->BindingHandle,
> > > > MacReceiveContext);
> > > > the Packet ALWAYS is NULL.Why is that?
> > > > Even Packet is NULL,the real packet to the
> > computer
> > > > still existed and passed through easily.
> > > > If I return NDIS_PACKET_FAILURE right after that
> > > > call
> > > > then the real packet was dropped(but Packet
> > still
> > > > NULL)?
> > > > Could anyone tell me what happen?How can I get
> > the
> > > > real packet to filter it(drop or pass it)?
> > > > Thank you very much.
> > > >
Hi Thomas,
I believe you have already given answer to this question.
Regards,
From: “Thomas F. Divine”
>Reply-To: “Windows System Software Devs Interest List”
>To: “Windows System Software Devs Interest List”
>Subject: [ntdev] Re: A problem about IM Driver
>Date: Sat, 13 Dec 2003 23:05:30 -0500
>
>In ProtocolReceive NEVER assume that NdisGetReceivedPacket will fetch
>anything other then NULL. You must write your code to accomodate that case
>where NdisGetReceivedPacket does not return a packet descriptor.
>
>If it does return a packet descriptor, make sure that you understand that
>the packet descriptor is only valid in the context of your ProtocolReceive
>handler. You cannot “claim” the packet (like you can in
>ProtocolReceivePacket). This means that you cannot call
>NdisMIndicateReceivePacket with the packet descriptor returned by
>NdisGetReceivedPacket.
>
>The DDK documents should be clear on this.
>
>Good luck,
>
>Thomas F. Divine
>www.rawether.net
>
>
>“Linh Nguyen” wrote in message news:xxxxx@ntdev…
> >
> > Thanks.But could you explain this to me:
> > In PtReceive,I used the call like below and I think if
> > the pointer Packet == NULL then the function didn’t
> > receive the packet and the packet just silently pass
> > through the filter.That was true because I could ping
> > and receive the packet.This means the function
> > PtReceive didn’t do anything.But when I intermediete
> > return after calling Packet =
> > NdisGetReceivedPacket(pAdapt->
> > BindingHandle,MacReceiveContext);
> > then the packet was lost even the pointer Packet was
> > NULL?
> >
> > — Michal Vodicka
> > wrote:
> > > Real packet isn’t available as NDIS_PACKET. You have
> > > to process packet data
> > > old way using header and lookahead buffers passed as
> > > parameters to
> > > ProtocolReceive. In the worst case you have to ask
> > > below miniport for the
> > > rest of data using NdisTransferData function.
> > >
> > > Maybe you should read NDIS docs before continuing.
> > >
> > > Best regards,
> > >
> > > Michal Vodicka
> > > STMicroelectronics Design and Application s.r.o.
> > > [michal.vodicka@st.com, http:://www.st.com]
> > >
> > > > ----------
> > > > From:
> > > xxxxx@yahoo.com[SMTP:xxxxx@yahoo.com]
> > > > Reply To: xxxxx@lists.osr.com
> > > > Sent: Saturday, December 13, 2003 2:23 AM
> > > > To: xxxxx@lists.osr.com
> > > > Subject: [ntdev] RE: A problem about IM Driver
> > > >
> > > > So what should I do to make it right(i.e get the
> > > real
> > > > packet?)
> > > >
> > > > — Bryan Burgin wrote:
> > > > >
> > > > >
> > > > > This will happen if the lower miniport indicates
> > > > > packets with the
> > > > > old-style NdisMEthIndicateReceive indication.
> > > > >
> > > > > Bryan S. Burgin
> > > > > xxxxx@microsoft.com
> > > > >
> > > > > This posting is provided “AS IS” with no
> > > warranties,
> > > > > and confers no
> > > > > rights.
> > > > >
> > > > >
> > > > > -----Original Message-----
> > > > > From: xxxxx@lists.osr.com
> > > > > [mailto:xxxxx@lists.osr.com] On
> > > Behalf
> > > > > Of Linh Nguyen
> > > > > Sent: Friday, December 12, 2003 2:55 PM
> > > > > To: Windows System Software Devs Interest List
> > > > > Subject: [ntdev] A problem about IM Driver
> > > > >
> > > > > Hi everyone
> > > > > I am writing a Packet Filter in Windows 2K using
> > > DDK
> > > > > 2000.I used the ExtendingPassthru Sample to
> > > build my
> > > > > driver and test it on the virtual
> > > > > marchine(VMWare).It
> > > > > worked very well but when I tried on the real
> > > > > machine,the problem occurred:
> > > > > The driver could bind to the NIC below but when
> > > I
> > > > > called
> > > > > Packet =
> > > > > NdisGetReceivedPacket(pAdapt->BindingHandle,
> > > > > MacReceiveContext);
> > > > > the Packet ALWAYS is NULL.Why is that?
> > > > > Even Packet is NULL,the real packet to the
> > > computer
> > > > > still existed and passed through easily.
> > > > > If I return NDIS_PACKET_FAILURE right after that
> > > > > call
> > > > > then the real packet was dropped(but Packet
> > > still
> > > > > NULL)?
> > > > > Could anyone tell me what happen?How can I get
> > > the
> > > > > real packet to filter it(drop or pass it)?
> > > > > Thank you very much.
> > > > >
>
>
>
>—
>Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>
>You are currently subscribed to ntdev as: xxxxx@hotmail.com
>To unsubscribe send a blank email to xxxxx@lists.osr.com
Find an old friend. Rediscover old joys! Reconnect across the miles & the years.
Well,if the miniport use the old-styled(first case),can we do anything to
get that packet?
There is no packet in this case.
All the packet data is available in:
1.) HeaderBuffer
2.) LookaheadBuffer
3.) By calling NdisTransferData if LookaheadBufferSize < PacketSize
So, you can fetch all the packet data.
If you MUST have a NDIS_PACKET to do some work, then you must construct one
yourself form the data provided to you when ProtoclReceive was called.
Understand that even if NdisGetReceivedPacket did return a NDIS packet
descriptor pointer, that pointer would only be valid while in the context of
the ProtocolReceive handler. You cannot “claim” the packet for queuing, etc.
in protocol receive.
Hope this helps.
Thomas F. Divine
www.pcausa.com
“Lee” wrote in message news:xxxxx@ntdev…
>
> Well,if the miniport use the old-styled(first case),can we do anything to
> get that packet?
>
>