NdisFSendNetBufferLists

NTDEV
1

Hi all.

I’m trying to send raw data packets from an NDIS 6 filter driver.

The basic logic is to allocate a buffer, an MDL describing the for mentioned buffer and then the NBL.
Set the NBL members(cancel Id etc.)
Then I send the NBL with NdisFSendNetBufferList() and check the send status when the SendNdisComplete callback is called.

I tried two devices -
1.A normal NIC
2.A Wifi NIC

When I send the data in option (1) the returned status is status_success but when I use option (2) (even after I connect to a network) I get status_unsuccessful.

What could cause this?

2

Is your LWF a ‘modifying’ filter driver?

Do you know what altitude the filter driver has been bound at over the WiFi
adapter?

Sending the packet formatted as Ethernet must be done from an altitude
‘above’ the Native WiFi filter driver where the apparent frame format is
Ethernet. The Native WiFi filter performs the frame format translation.
Attempting to inject a frame from an altitude between the Native WiFi filter
and the adapter is quite problematic.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Thursday, October 01, 2009 10:32 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] NdisFSendNetBufferLists

Hi all.

I’m trying to send raw data packets from an NDIS 6 filter driver.

The basic logic is to allocate a buffer, an MDL describing the for mentioned
buffer and then the NBL.
Set the NBL members(cancel Id etc.)
Then I send the NBL with NdisFSendNetBufferList() and check the send status
when the SendNdisComplete callback is called.

I tried two devices -
1.A normal NIC
2.A Wifi NIC

When I send the data in option (1) the returned status is status_success but
when I use option (2) (even after I connect to a network) I get
status_unsuccessful.

What could cause this?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

My driver sends NDIS buffers independently of other packets it receives via normal IO.
It just generates “new” ones.
The packets I’m sending are valid Ethernet packets and my driver is adapted from the DDK’s sample of a lightweight filter driver - “…ndis/filter” (and I use the same inf).

Is there anything else I should check?
How can I ensure that my driver is installed above (or for that matter, below) the Native WiFi filter?
I can’t understand why the behavior is different in both cases.

4

If you copied the NDISLWF sample then you ended up with:

  • A modifying filter driver (FilterType=2)
  • Bound above NativeWiFi - infact, at the layer called “compression”
    (FilterClass=compression)
  • As a ‘mandatory’ filter that must run if any protocols will be allowed to
    bind (FilterRunType=1)
  • Bound to only NICs that advertise “ethernet” as the frame-type
    (FilterMediaTypes=“ethernet”)

I don’t have a definite answer as to why it does not work for WiFi if it
works as you say for wired Ethernet. Perhaps you need to pay more attention
to how you allocate your buffers to ensure that you allocate enough space
for NativeWiFi to retreat the head of the NB to do whatever it needs to do
to build the 802.11 frame.

Hopefully Thomas will note this thread and chime in.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Thursday, October 01, 2009 11:03 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] NdisFSendNetBufferLists

My driver sends NDIS buffers independently of other packets it receives via
normal IO.
It just generates “new” ones.
The packets I’m sending are valid Ethernet packets and my driver is adapted
from the DDK’s sample of a lightweight filter driver - “…ndis/filter” (and
I use the same inf).

Is there anything else I should check?
How can I ensure that my driver is installed above (or for that matter,
below) the Native WiFi filter?
I can’t understand why the behavior is different in both cases.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

I just ran tests using a modifying NDIS 6 LWF attached to a Native 802.11
Wi-Fi adapter on Windows 7.

The test rig injects user-created 802.3 packets both up and down the adapter
stack without any problem.

Of course, the Wi-Fi adapter must be connected for this to work.

Like Dave, I don’t know of any reason why you shouldn’t be successful unless
you have screwed up some detail of the NB and NBL that you create.

Finally, comments like “if doesn’t work” aren’t helpful. Does some operation
fail? If so, what is the error code, etc. It there are no faults detected in
returns from calling NDIS APIs, how do you conclude “that it doesn’t work”?

Are these sends “down” to the network adapter or receive indications
directed “up” to the host?

Good luck!

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley
Sent: Thursday, October 01, 2009 11:48 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] NdisFSendNetBufferLists

If you copied the NDISLWF sample then you ended up with:

  • A modifying filter driver (FilterType=2)
  • Bound above NativeWiFi - infact, at the layer called “compression”
    (FilterClass=compression)
  • As a ‘mandatory’ filter that must run if any protocols will be allowed to
    bind (FilterRunType=1)
  • Bound to only NICs that advertise “ethernet” as the frame-type
    (FilterMediaTypes=“ethernet”)

I don’t have a definite answer as to why it does not work for WiFi if it
works as you say for wired Ethernet. Perhaps you need to pay more attention
to how you allocate your buffers to ensure that you allocate enough space
for NativeWiFi to retreat the head of the NB to do whatever it needs to do
to build the 802.11 frame.

Hopefully Thomas will note this thread and chime in.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Thursday, October 01, 2009 11:03 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] NdisFSendNetBufferLists

My driver sends NDIS buffers independently of other packets it receives via
normal IO.
It just generates “new” ones.
The packets I’m sending are valid Ethernet packets and my driver is adapted
from the DDK’s sample of a lightweight filter driver - “…ndis/filter” (and
I use the same inf).

Is there anything else I should check?
How can I ensure that my driver is installed above (or for that matter,
below) the Native WiFi filter?
I can’t understand why the behavior is different in both cases.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

Thomas -

“I just ran tests using a modifying NDIS 6 LWF attached to a Native 802.11 Wi-Fi adapter on Windows 7.” –> I’m trying to run my driver on Vista SP1
“The test rig injects user-created 802.3 packets both up and down the adapter stack without any problem. Of course, the Wi-Fi adapter must be connected for this to work.” –> sending NBL’s while the wifi nic is not connected result with the error network disconnected (or something similar) but as soon as a connection is made, I start getting STATUS_UNSUCCESSFUL on the sendNBLComplete callback.

“Like Dave, I don’t know of any reason why you shouldn’t be successful unless you have screwed up some detail of the NB and NBL that you create.” –> Why would it work with a normal LAN NIC and not a Wifi NIC then?

Finally, comments like “if doesn’t work” aren’t helpful. Does some operation fail? If so, what is the error code, etc. It there are no faults detected in returns from calling NDIS APIs, how do you conclude “that it doesn’t work”?" –> I sniff the traffic on the wire/air and check if packets were sent.
sniffing the traffic locally doesn’t work since all the sniffers I know are attached above my driver.

7

Using a Netgear VN111v2 I never saw any STATUS_UNSUCCESSFUL errors in send
or indicate complete callbacks.

HOWEVER, using AirPCap I did NOT see my test packets in the air…

UNTIL I removed the Jumpstart Wireless (JWS) filter driver (a Netgear
ad-on…). After I removed JSW the test packets were seen in the air.

This was on Windows 7 running under VMWare.

Hope this helps and Good luck!

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@hotmail.com
Sent: Thursday, October 01, 2009 4:59 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] NdisFSendNetBufferLists

Thomas -

“I just ran tests using a modifying NDIS 6 LWF attached to a Native 802.11
Wi-Fi adapter on Windows 7.” –> I’m trying to run my driver on Vista SP1
“The test rig injects user-created 802.3 packets both up and down the
adapter stack without any problem. Of course, the Wi-Fi adapter must be
connected for this to work.” –> sending NBL’s while the wifi nic is not
connected result with the error network disconnected (or something similar)
but as soon as a connection is made, I start getting STATUS_UNSUCCESSFUL on
the sendNBLComplete callback.

“Like Dave, I don’t know of any reason why you shouldn’t be successful
unless you have screwed up some detail of the NB and NBL that you create.”
–> Why would it work with a normal LAN NIC and not a Wifi NIC then?

Finally, comments like “if doesn’t work” aren’t helpful. Does some
operation fail? If so, what is the error code, etc. It there are no faults
detected in returns from calling NDIS APIs, how do you conclude “that it
doesn’t work”?" –> I sniff the traffic on the wire/air and check if
packets were sent.
sniffing the traffic locally doesn’t work since all the sniffers I know are
attached above my driver.

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

8

Trying to keep this post alive.
The problem persists - I can’t send my own generated (and valid) Ethernet packets down the NDIS stack.

My way of using the NBL:

1.I allocate the actual buffer using ndisAllocateMemoryWithTagPriority() and connect the data with the device I intend to send it through
2.I Allocate an MDL using NdisAllocateMDL() (and connect the MDL with the previously allocated buffer, and the device I intend to send the data through)
3.I Call NdisAllocateNetBufferAndNetBufferList()r the MDL and a previously allocated pool
4.I Set the cancel ID
5.I Set the SourceHandle to the same device I used in 1 and 2.
6.I Send the data using NdisfSendNetBufferLists

I’ve noticed that the NBL’s protocol and flags fields are not empty and wondered if that had something to do with it.
I tried nullifying them, but all completed packets indicated an NDIS_STATUS_FAILURE.