How does filmon detect network volumes to monitor?

NTFSD
1

I would like to use filmon from sysinternals.com to monitor
my redirector, but my drive letter doesn’t show up in the
list of drives to monitor. (It does show up in net use
though, for example.)

Does anyone know how Filemon is enumerating the drives
to put in the menu and what I need to do in my redirector
be enumerated?

Thanks,

Joseph

2

Joseph Galbraith wrote:

I would like to use filmon from sysinternals.com to monitor
my redirector, but my drive letter doesn’t show up in the
list of drives to monitor. (It does show up in net use
though, for example.)

Does anyone know how Filemon is enumerating the drives
to put in the menu and what I need to do in my redirector
be enumerated?

Okay, I’ve followed up on this a little, and realize that
the drive letter isn’t going to show up. With the
network menu item checked, though, I see trace from
the native smb redirector, but not from the smb sample
or from my redirector.

Anyone have any clues?

Thanks,

Joseph

3

> network menu item checked, though, I see trace from

the native smb redirector, but not from the smb sample
or from my redirector.

Anyone have any clues?

Well, let’s do some hacking.
If you unpack the NT driver from the Filemon.exe
and look at in in the hexa editor, you may find several
strings “\Device\LanmanRedirector”.

So I guess that Filemon gets the device object by name
(Using IoGetDeviceObjectPointer) and attaches to it.
If your redirector uses another name, filemon
does not care about it.

L.