NDIS packets to TCP/IP packets.

NTDEV
1

Hi,

I have developed a NDIS protocol driver to communicate with etherenet based local device. i am able communicate and perform I/O operations with device without any problem through an test application.

Now i want to simulate the data that i am receiving from device. basically my test application should work even if device is not connected, without any change in test application and driver source code.

Hence, i want to develop a separate simulator application that can write on data on ethernet port and in parallel my test application will be able to read data the using NDIS protocol driver.

Now, my question is what are the possibilites to send packets from simulator application and read these packets through NDIS protocol driver?

Is it possible through TCP/IP sockets?

Thanks in advance

2

Since you have written a protocol driver you could:

  1. Write another protocol driver and send loopback packets to your other
    protocol driver.

  2. Write a ‘virtual adapter’ driver and inject/capture packets from it via
    an auxiliary device object. This simulates an entire ‘network’ over which
    you have complete control (as if the simulated device were the only thing
    attached to the ethernet port).

  3. Use another computer on the network to emulate the device and use
    whatever scheme is necessary on that computer to send & receive packets in
    the format you wish (quite possibly your protocol driver could be used for
    this as well, no?)

Does the ‘device’ use the TCP/IP protocol suite to communicate? If so, they
why did you need to write a protocol?

If it does not, then no, you cannot use ‘sockets’ to send MAC level packets
for a private protocol. That is why you wrote a protocol driver.

Good Luck,
Dave Cattley

3

Thanks David,

I understood why cant we use TCP/IP suite to communicate with device.

I have some queries.

What do you mean by ‘Virtual Adapter’ driver?

Does it mean, i have to write another protocol driver. if yes then can i use existing protocol driver code and write a new protocol driver with different name and service.

If i do so, then is it possible that multiple protocol drivers can run in parallel?

i.e. one protocol driver can write data on adaptor and another can read the same data simultaneosly.

Regards,
Devender

4

> What do you mean by ‘Virtual Adapter’ driver?

Mr. Cattley is referring to a virtual network card driver. You can write a driver that registers itself with the OS as a network adapter, but secretly doesn’t have any network hardware. Instead, it gets its packets from a usermode control application (for example, your test app). The WDK includes a sample of this, named “netvmini”.

Does it mean, i have to write another protocol driver.

Yes this is one option, which Mr. Cattley listed as option 1. Option 1 is to write a protocol driver. Option 2 is to write a virtual adapter. You don’t need both.

then can i use existing protocol driver code and write a new protocol driver with different name and service.

Sure.

If i do so, then is it possible that multiple protocol drivers can run in parallel?

Yes. You can easily see that today – your system probably has the TCPIP and TCPIP6 protocols running in parallel.

Note that, while protocol drivers can exchange packets (if you put them into promiscuous mode), this isn’t the “natural” way of NDIS. NDIS is optimized for protocol-to-adapter communication. If your goal is to test your protocol driver, then a protocol-to-adapter design will most closely simulate what happens when you bind the protocol to a “real” network adapter. Your test virtual adapter will be able to simulate conditions like media-disconnect, link-speed-change, and hardware-surprise-removal; which can’t be easily simulated with just a test protocol.

The main reason to use a 2nd protocol driver is because it might be easier, especially if you’ve already gotten one written.

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@igatepatni.com
Sent: Friday, October 07, 2011 1:43 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] NDIS packets to TCP/IP packets.

Thanks David,

I understood why cant we use TCP/IP suite to communicate with device.

I have some queries.

What do you mean by ‘Virtual Adapter’ driver?

Does it mean, i have to write another protocol driver. if yes then can i use existing protocol driver code and write a new protocol driver with different name and service.

If i do so, then is it possible that multiple protocol drivers can run in parallel?

i.e. one protocol driver can write data on adaptor and another can read the same data simultaneosly.

Regards,
Devender

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Thanks Jeffery i got your points.

Regards,
Devender

6

The only thing I would add to Mr. Tippet’s excellent clarifications is that
while indeed one way to leverage ‘another’ protocol driver is to install it
bound side-by-side on the same machine, I was actually thinking that the
‘other’ protocol driver and device simulation UM code would run on another
machine attached to the network. This eliminates having to add support for
promiscuous mode (actually, only ‘all local’ is required) to the packet
filter bits on the original protocol driver and the test protocol driver.

Thanks Jeffery for adding some sense to my ramble.

Good Luck,
Dave Cattley

7

Thanks David for more information.

If i keep both my protocol drivers (one for application and another for simulator) in promiscuous mode, then would it impact on receiving/sending packets on same network using other protocols like TCP/IP and vice versa?

Regards,
Devender

8

The impact would be similar to running a tool like Wireshark which also binds a protocol to the NIC and sets promiscuous mode on its binding’s packet filter. The primary impact (cost) to the system is that it now must indicate all sent packets as receive packets into your (two) protocol bindings. That is *ALL* sent packets, not just yours. Unless you are already pushing the platform and TCP/IP near to its saturation limits, I doubt this will be a performance impact you actually can observe casually. And since this is clearly a ‘test’ harnelss, it falls into the ‘does it matter’ category. By the way, I may not have been clear on this. You only need to set the NDIS_PACKET_TYPE_ALL_LOCAL bit in your setting to OID_GEN_CURRENT_PACKET_FILTER to get packets indicated that are ‘sent’ from other bindings on the same adapter. The bit NDIS_PACKET_TYPE_PROMISCUOUS may be more than you need and you might want to avoid enabling it just because it changes the behavior of the stack below (the NIC has to do something) whereas “all local” just changes how NDIS treats sends from other bindings relative to your binding. Good Luck,Dave Cattley
> Date: Mon, 10 Oct 2011 00:53:47 -0400

From: xxxxx@igatepatni.com
To: xxxxx@lists.osr.com
Subject: RE:[ntdev] NDIS packets to TCP/IP packets.

Thanks David for more information.

If i keep both my protocol drivers (one for application and another for simulator) in promiscuous mode, then would it impact on receiving/sending packets on same network using other protocols like TCP/IP and vice versa?

Regards,
Devender

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

9

Thanks David,

I got your points. I have not set it to local because my original driver has to communicate with the device as well, but i have changed the default frame type from 0x8e88 to other specific frame type for both the drivers, which can be only understand by my protocol drivers.

Regards,
Devender