I have a miniport driver that I am currently testing. For some reason it doesn’t default to promiscuous mode. I know this is set by the protocol driver. How do I make sure this is defaulted?
Right now, when I open Wireshark it sets up promiscuous mode. Which is what I want, but then defaults back to broacast/multicast only when I close it.
A miniport driver is initialized to shut off all RX. Registed protocol
drivers selectively turn on what it wants to hear by sending an set filter
OID to the miniport.
For debugging, you can turn on promiscuous mode after your driver is ready
to handle receive.
Calvin
On Tue, Aug 28, 2012 at 4:27 PM, wrote:
> I have a miniport driver that I am currently testing. For some reason it
> doesn’t default to promiscuous mode. I know this is set by the protocol
> driver. How do I make sure this is defaulted?
>
> Right now, when I open Wireshark it sets up promiscuous mode. Which is
> what I want, but then defaults back to broacast/multicast only when I close
> it.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Ok. My driver fails to receive directed packets because promiscuous mode is disabled. When do protocol drivers enable this with the appropriate OID? This is a problem because my network device cannot connect to the internet (when promiscuous mode is disabled). Am I missing something?
Network transports like TCP/IP usually never enable promiscuous mode. It’s generally only used for diagnostics, although there are cases where something like the HyperV vSwitch wants to process packets for many MAC addresses across VMs, then it’s enabled. Since Ethernet is pretty much always distributed via a learning switch, even NIC promiscuous mode is essentially filtered by a switch. The cluster load balancing driver might also enable promiscuous mode, as it does unusual things with MAC addresses. As I remember, the WHQL spec says a NIC needs to have filters for 32 MAC addresses, so you can get unicast and multicast packets, even though you are not in promiscuous mode.
Jan
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Tuesday, August 28, 2012 11:05 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] NDIS Miniport Promiscuous Mode
Ok. My driver fails to receive directed packets because promiscuous mode is disabled. When do protocol drivers enable this with the appropriate OID? This is a problem because my network device cannot connect to the internet (when promiscuous mode is disabled). Am I missing something?
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
On 29-Aug-2012 02:27, xxxxx@gmail.com wrote:
I have a miniport driver that I am currently testing. For some reason it doesn’t default to promiscuous mode. I know this is set by the protocol driver. How do I make sure this is defaulted?
Right now, when I open Wireshark it sets up promiscuous mode. Which is what I want, but then defaults back to broacast/multicast only when I close it.
a. Add some special parameter for your miniport to start and stay in
promisc. mode (but, as you noted, this is not a normal default. Later
the in-box protocols will reset it).
b. Make your own little private sniffer (save all data to file in format
understandable by Netmon or wireshark; you can even write a custom
decoder for netmon)
– pa
Thanks. If a NIC is not in promiscuous mode (as is the default), what else could be preventing my NIC from receiving directed packets? or rather, what is preventing it from receiving pings, or connecting to the internet?
It could be your nic is not setup correctly, or your nic has a bug that
will not receive unicast packets. The first thing to check: Does your nic
require setting MAC address? If yes, did you set it right?
Ask you hw folks. This is nic specific.
Calvin
On Wed, Aug 29, 2012 at 9:07 AM, wrote:
> Thanks. If a NIC is not in promiscuous mode (as is the default), what else
> could be preventing my NIC from receiving directed packets? or rather, what
> is preventing it from receiving pings, or connecting to the internet?
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
Thanks. I fixed it. It was a MAC address problem. I was setting it incorrectly in hardware. Thanks a lot!