Do DFS IRPs go via LanManRedirector ?

NTFSD
1

Hi,

my file filter driver (running on W2K network clients) attaches to
LanmanRedirector to analyze IRPs that deal with file activity on remote
drives. However, requests on DFS volumes are not “seen” by our filter.
As a partial workaround we attach to the drive mappings to DFS volumes,
because we do receive IRPs for the DFS volume in this way.

How can we make sure that we also receive the IRPs if the user is
accessing a file on the DFS via UNC ? Any clues ?

Best,

Bartjan Wattel.

2

Barjan,

Normally, this is a load ordering issue. DFS is obtaining its pointer to
the LanmanRedirector device object BEFORE your filter attaches and, as a
result, you “miss” the IRPs that DFS sends to LanmanRedirector. You can
confirm this by setting a breakpoint in one of the Lanman entry points and
looking at the stack - the IRPs that you see will not have your device
present in the call stack.

This is a classic problem for device filters that is not normally observed
by file system filter drivers, because normally the I/O Manager re-evaluates
the device stack prior to sending each new IRP. DFS (and other drivers) do
not do so, although I have long maintained that this is not a robust design
for any driver that attempts to act like the I/O Manager.

Regards,

Tony

Tony Mason

Consulting Partner

OSR Open Systems Resources, Inc.

http://www.osr.com

-----Original Message-----
From: Bartjan Wattel [mailto:xxxxx@zeelandnet.nl]
Sent: Monday, June 17, 2002 5:33 AM
To: File Systems Developers
Subject: [ntfsd] Do DFS IRPs go via LanManRedirector ?

Hi,

my file filter driver (running on W2K network clients) attaches to
LanmanRedirector to analyze IRPs that deal with file activity on remote
drives. However, requests on DFS volumes are not “seen” by our filter. As a
partial workaround we attach to the drive mappings to DFS volumes, because
we do receive IRPs for the DFS volume in this way.

How can we make sure that we also receive the IRPs if the user is accessing
a file on the DFS via UNC ? Any clues ?

Best,

Bartjan Wattel.

You are currently subscribed to ntfsd as: xxxxx@osr.com
To unsubscribe send a blank email to %%email.unsub%%