NDIS driver problem (ARP doesn't get a response)

NTDEV
1

I’ve written an NDIS driver for a special purpose piece of hardware.

Sends work fine.

Receives don’t.

I read the data (ARP request in this case) from the hardware and place it in buffer
in a packet and call NdisMIndicateReceivePacket

and the stack seems to get it, but it never generates an ARP response

Possibly useful additional details
Currently running and debugging under WinCE 5.0 (will also run under XP, but later)
NDIS 5.1 – deserialized
entire msg is in one buffer chained to packet (ARP rqst is pretty short)
stack does call back to to my MPReturnPacket function (apparently normally)

I’m looking for any suggestions on
a) why the stack would ignore an apparently valid packet that is addressed to
the correct IP and MAC
b) how I might go about debugging further (can’t seem to step into NdisMIndicateReceivePacket)

Thanx
Mike Loving

Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs

2

Mike Loving wrote:

I’m looking for any suggestions on a) why the stack would ignore an
apparently valid packet that is addressed to the correct IP and MAC

Bad checksum? Can you load Network Monitor and see if it complains?

3

checksum is ok by my calculations and the packet is sent by a linux system which has
calculated the checksum. I am of the belief that the checksum is correct.

I’m not familiar with network monitor.

----- Original Message ----
From: “xxxxx@gmail.com”
To: Windows System Software Devs Interest List
Sent: Sunday, January 6, 2008 7:55:33 PM
Subject: RE:[ntdev] NDIS driver problem (ARP doesn’t get a response)

Mike Loving wrote:

> I’m looking for any suggestions on a) why the stack would ignore an
> apparently valid packet that is addressed to the correct IP and MAC

Bad checksum? Can you load Network Monitor and see if it complains?

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

____________________________________________________________________________________
Looking for last minute shopping deals?
Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

4

Mike Loving wrote:

checksum is ok by my calculations and the packet is sent by a linux
system which has calculated the checksum. I am of the belief that
the checksum is correct.

Ok. Have you tried narrowing down the list of possibilities by trying to receive some other packet other than an ARP reply? You could populate the ARP table on the host manually and then try some unicast traffic and see if it gets through. Or you could send a broadcast from the device…

5

sends work fine, so I am not worried about sends

It is an ARP request that I am trying to receive (i.e. I expect to see the
network stack send an ARP response)

my windows system can send an ARP request to the linux system and
the linux system sends an ARP response, my windows system does not
seem to recognize the ARP response that it receives either

basically, I am trying to make ping work and ping sends ARPs before
it sends ICMP ping packets

----- Original Message ----
From: “xxxxx@gmail.com”
To: Windows System Software Devs Interest List
Sent: Sunday, January 6, 2008 8:17:23 PM
Subject: RE:[ntdev] NDIS driver problem (ARP doesn’t get a response)

Mike Loving wrote:

> checksum is ok by my calculations and the packet is sent by a linux
> system which has calculated the checksum. I am of the belief that
> the checksum is correct.

Ok. Have you tried narrowing down the list of possibilities by trying
to receive some other packet other than an ARP reply? You could
populate the ARP table on the host manually and then try some unicast traffic
and see if it gets through. Or you could send a broadcast from the
device…

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs

6

Do you set the destination MAC and IP address correctly in the packet you
are passing to indicate receive?

Using a network monitor to observe the received packet may help. It is easy
to fool one’s self by your own calculations, but a decent (even free)
network monitor may point out something you have overlooked. WireShark will
do the trick.

Thomas

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Loving
Sent: Monday, January 07, 2008 12:24 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] NDIS driver problem (ARP doesn’t get a response)

sends work fine, so I am not worried about sends

It is an ARP request that I am trying to receive (i.e. I expect to see the
network stack send an ARP response)

my windows system can send an ARP request to the linux system and
the linux system sends an ARP response, my windows system does not
seem to recognize the ARP response that it receives either

basically, I am trying to make ping work and ping sends ARPs before
it sends ICMP ping packets

----- Original Message ----
From: “xxxxx@gmail.com”
To: Windows System Software Devs Interest List
Sent: Sunday, January 6, 2008 8:17:23 PM
Subject: RE:[ntdev] NDIS driver problem (ARP doesn’t get a response)

Mike Loving wrote:

> checksum is ok by my calculations and the packet is sent by a linux
> system which has calculated the checksum. I am of the belief that
> the checksum is correct.

Ok. Have you tried narrowing down the list of possibilities by trying to
receive some other packet other than an ARP reply? You could populate the
ARP table on the host manually and then try some unicast traffic and see if
it gets through. Or you could send a broadcast from the device…

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

_____

Never miss a thing. Make Yahoo
http: your homepage.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer</http:>

7

well, I can certainly run the arp packet by wireshark and see what it says
because it *is* possible that linux sent the ARP request malformed and it
is also possible that my own (and another guy’s) inspection of the contents of
the (very brief) ARP request packet is mistaken, but . . . . .

we are hoping that there is something in OID settings or some other thing that
we know nothing about that would cause the network stack to

ignore ARP requests (what it is doing)

----- Original Message ----
From: Thomas F. Divine
To: Windows System Software Devs Interest List
Sent: Sunday, January 6, 2008 9:41:01 PM
Subject: RE: [ntdev] NDIS driver problem (ARP doesn’t get a response)



Do you set the destination MAC and IP address correctly in the
packet you are passing to indicate receive?

Using a network monitor to observe the received packet may help.
It is easy to fool one?s self by your own calculations, but a decent
(even free) network monitor may point out something you have overlooked.
WireShark will do the trick.

Thomas

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Loving

Sent: Monday, January 07, 2008 12:24 AM

To: Windows System Software Devs Interest List

Subject: Re: [ntdev] NDIS driver problem (ARP doesn’t get a response)

sends work fine, so I am not worried about
sends

It is an ARP request that I am trying to receive (i.e. I expect to see the

network stack send an ARP response)

my windows system can send an ARP request to the linux system and

the linux system sends an ARP response, my windows system does not

seem to recognize the ARP response that it receives either

basically, I am trying to make ping work and ping sends ARPs before

it sends ICMP ping packets

----- Original Message ----

From: “xxxxx@gmail.com”

To: Windows System Software Devs Interest List

Sent: Sunday, January 6, 2008 8:17:23 PM

Subject: RE:[ntdev] NDIS driver problem (ARP doesn’t get a response)

Mike Loving wrote:

> checksum is ok by my calculations and the packet is sent by a linux

> system which has calculated the checksum. I am of the belief that

> the checksum is correct.

Ok. Have you tried narrowing down the list of possibilities by trying to
receive some other packet other than an ARP reply? You could populate the
ARP table on the host manually and then try some unicast traffic and see if it
gets through. Or you could send a broadcast from the device…

—

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:

http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

Never miss a thing. Make Yahoo
your homepage.

—

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:

http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:

http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

____________________________________________________________________________________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs

8

Hi Mike!

I had this issue, then the error was that the data was not 32-bit alligned. I could still see the data in “sniffers”, but windows ignored it.

Worth checking…

Best Regards

Mats Soderhall

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Mike Loving
Sent: den 7 januari 2008 04:22
To: Windows System Software Devs Interest List
Subject: [ntdev] NDIS driver problem (ARP doesn’t get a response)

I’ve written an NDIS driver for a special purpose piece of hardware.

Sends work fine.

Receives don’t.

I read the data (ARP request in this case) from the hardware and place it in buffer
in a packet and call NdisMIndicateReceivePacket

and the stack seems to get it, but it never generates an ARP response

Possibly useful additional details
Currently running and debugging under WinCE 5.0 (will also run under XP, but later)
NDIS 5.1 – deserialized
entire msg is in one buffer chained to packet (ARP rqst is pretty short)
stack does call back to to my MPReturnPacket function (apparently normally)

I’m looking for any suggestions on
a) why the stack would ignore an apparently valid packet that is addressed to
the correct IP and MAC
b) how I might go about debugging further (can’t seem to step into NdisMIndicateReceivePacket)

Thanx
Mike Loving

Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http:
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
###########################################

This message has been scanned by F-Secure Anti-Virus for Microsoft Exchange.
For more information, connect to http://www.f-secure.com/</http:>

9

Verify that you have set the header length in the NDIS_PACKET OOB data
before indicating the packet as a receive.

Good Luck,
Dave Cattley
Consulting Engineer
Systems Software Development

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Loving
Sent: Monday, January 07, 2008 1:52 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] NDIS driver problem (ARP doesn’t get a response)

well, I can certainly run the arp packet by wireshark and see what it says
because it *is* possible that linux sent the ARP request malformed and it
is also possible that my own (and another guy’s) inspection of the contents
of
the (very brief) ARP request packet is mistaken, but . . . . .

we are hoping that there is something in OID settings or some other thing
that
we know nothing about that would cause the network stack to

ignore ARP requests (what it is doing)

----- Original Message ----
From: Thomas F. Divine
To: Windows System Software Devs Interest List
Sent: Sunday, January 6, 2008 9:41:01 PM
Subject: RE: [ntdev] NDIS driver problem (ARP doesn’t get a response)

Do you set the destination MAC and IP address correctly in the packet you
are passing to indicate receive?

Using a network monitor to observe the received packet may help. It is easy
to fool one?s self by your own calculations, but a decent (even free)
network monitor may point out something you have overlooked. WireShark will
do the trick.

Thomas

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Mike Loving
Sent: Monday, January 07, 2008 12:24 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] NDIS driver problem (ARP doesn’t get a response)

sends work fine, so I am not worried about sends

It is an ARP request that I am trying to receive (i.e. I expect to see the
network stack send an ARP response)

my windows system can send an ARP request to the linux system and
the linux system sends an ARP response, my windows system does not
seem to recognize the ARP response that it receives either

basically, I am trying to make ping work and ping sends ARPs before
it sends ICMP ping packets

----- Original Message ----
From: “xxxxx@gmail.com”
To: Windows System Software Devs Interest List
Sent: Sunday, January 6, 2008 8:17:23 PM
Subject: RE:[ntdev] NDIS driver problem (ARP doesn’t get a response)

Mike Loving wrote:

> checksum is ok by my calculations and the packet is sent by a linux
> system which has calculated the checksum. I am of the belief that
> the checksum is correct.

Ok. Have you tried narrowing down the list of possibilities by trying to
receive some other packet other than an ARP reply? You could populate the
ARP table on the host manually and then try some unicast traffic and see if
it gets through. Or you could send a broadcast from the device…

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer



Never miss a thing. Make Yahoo your homepage.
http:
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer



Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try
http:HDtDypao8Wcj9tAcJ> it now.
—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer</http:></http:>

10

Are you able to install your hardware on a CEPC or does your target platform support KITL debugging? If so, load the Debug version of NDIS.DLL on the platform, turn on the Debug Zones releated to receive and packet filtering. You might also turn on the internal NDIS ‘verifier’ level Debug Areas and Level. The debug output from Platform Builder may very well indicate what is wrong with the packet.

If you can bring up the driver on XP or later, use !ndiskd to dump the packet just before you are going to indicate it to NDIS and inspect the output. It may well illuminate what the problem is.

On CE you should be able to step into NDIS and/or set break-points in TCPSTK.DLL to see if/why your packet is ignored. Assuming the miniport is emulating an 802.3 (Ethernet) miniport, the Eth filter package is likely the layer rejecting the packet. You can find the internal NDIS name for the routines by inspecting the linker map for NDIS.DLL in your %FLATRELEASEDIR%.

Disabling “Source Mode” in the PB debugger ought to be enough to allow you to “step into” the call to NdisMIndicateReceivePacket(). If not, you can always look at the destination address (it is a call through a pointer in the miniport block) .

Good Luck,
Dave Cattley
Consulting Engineer
Systems Software Development
“Mike Loving” wrote in message news:xxxxx@ntdev…
I’ve written an NDIS driver for a special purpose piece of hardware.

Sends work fine.

Receives don’t.

I read the data (ARP request in this case) from the hardware and place it in buffer
in a packet and call NdisMIndicateReceivePacket

and the stack seems to get it, but it never generates an ARP response

Possibly useful additional details
Currently running and debugging under WinCE 5.0 (will also run under XP, but later)
NDIS 5.1 – deserialized
entire msg is in one buffer chained to packet (ARP rqst is pretty short)
stack does call back to to my MPReturnPacket function (apparently normally)

I’m looking for any suggestions on
a) why the stack would ignore an apparently valid packet that is addressed to
the correct IP and MAC
b) how I might go about debugging further (can’t seem to step into NdisMIndicateReceivePacket)

Thanx
Mike Loving

------------------------------------------------------------------------------
Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.