No ARP reply

NTDEV
1

Hi

I’m busy with the final section of an USB ethernet device. I’m using WinPcap to check the ethernet packet and everything looks good.
When I send a ‘ping’ request to the device I can see the packet received but I get no reply from my computer.
What could cause this I have look at the data in the ARP packet and everything is as it should be. Windows firewall is disabled.

Thanks Johan

2

Johan,

where in your case is ARP related to your ping request? I mean ARP is for
converting an IP to MAC address…those ARP-packets are handled before any
IP traffic takes place. If your adapter is receiving an ICMP (ping) packet,
the remote machine has already converted your IP to MAC via ARP
successfully.

schrieb im Newsbeitrag news:xxxxx@ntdev…
> Hi
>
> I’m busy with the final section of an USB ethernet device. I’m using
> WinPcap to check the ethernet packet and everything looks good.
> When I send a ‘ping’ request to the device I can see the packet received
> but I get no reply from my computer.
> What could cause this I have look at the data in the ARP packet and
> everything is as it should be. Windows firewall is disabled.
>
> Thanks Johan
>

3

The ‘ping’ is sent to identify the MAC address. The sending computer is
using the broadcast address. My device receives the packet but not reply is
sent back.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of frank
Sent: Tuesday, December 12, 2006 10:37 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] No ARP reply

Johan,

where in your case is ARP related to your ping request? I mean ARP is for
converting an IP to MAC address…those ARP-packets are handled before any
IP traffic takes place. If your adapter is receiving an ICMP (ping) packet,
the remote machine has already converted your IP to MAC via ARP
successfully.

schrieb im Newsbeitrag news:xxxxx@ntdev…
> Hi
>
> I’m busy with the final section of an USB ethernet device. I’m using
> WinPcap to check the ethernet packet and everything looks good.
> When I send a ‘ping’ request to the device I can see the packet received
> but I get no reply from my computer.
> What could cause this I have look at the data in the ARP packet and
> everything is as it should be. Windows firewall is disabled.
>
> Thanks Johan
>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

4

Try using the adress of your device instead of a broadcast and see what
happens.

–

EA

The ‘ping’ is sent to identify the MAC address. The sending computer is
using the broadcast address. My device receives the packet but not reply
is
sent back.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of frank
Sent: Tuesday, December 12, 2006 10:37 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] No ARP reply

Johan,

where in your case is ARP related to your ping request? I mean ARP is for
converting an IP to MAC address…those ARP-packets are handled before
any
IP traffic takes place. If your adapter is receiving an ICMP (ping)
packet,
the remote machine has already converted your IP to MAC via ARP
successfully.

schrieb im Newsbeitrag news:xxxxx@ntdev…
>> Hi
>>
>> I’m busy with the final section of an USB ethernet device. I’m using
>> WinPcap to check the ethernet packet and everything looks good.
>> When I send a ‘ping’ request to the device I can see the packet received
>> but I get no reply from my computer.
>> What could cause this I have look at the data in the ARP packet and
>> everything is as it should be. Windows firewall is disabled.
>>
>> Thanks Johan
>>
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
EA

5

Hi
I manually configured the IP-to-Physical translation table on the sending
computer. Now when I do a ‘ping’ my device receives an ‘ICMP echo request’
packet.
My receiving computer doesn’t respond to this either.
When I look at my network connection status it indicates that I am receiving
packets.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Edouard Alligand
Sent: Tuesday, December 12, 2006 10:59 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

Try using the adress of your device instead of a broadcast and see what
happens.

–

EA

The ‘ping’ is sent to identify the MAC address. The sending computer is
using the broadcast address. My device receives the packet but not reply
is
sent back.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of frank
Sent: Tuesday, December 12, 2006 10:37 AM
To: Windows System Software Devs Interest List
Subject: Re:[ntdev] No ARP reply

Johan,

where in your case is ARP related to your ping request? I mean ARP is for
converting an IP to MAC address…those ARP-packets are handled before
any
IP traffic takes place. If your adapter is receiving an ICMP (ping)
packet,
the remote machine has already converted your IP to MAC via ARP
successfully.

schrieb im Newsbeitrag news:xxxxx@ntdev…
>> Hi
>>
>> I’m busy with the final section of an USB ethernet device. I’m using
>> WinPcap to check the ethernet packet and everything looks good.
>> When I send a ‘ping’ request to the device I can see the packet received
>> but I get no reply from my computer.
>> What could cause this I have look at the data in the ARP packet and
>> everything is as it should be. Windows firewall is disabled.
>>
>> Thanks Johan
>>
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
EA

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

6

MS’s “Network Monitor” utility will probably be helpful here as you diagnose this.

I suspect you have bad checksums in your packets and so the receiving end is dropping them.

7

Hi
I installed the MS “Network Monitor”. I can see the ARP request packets
being received, but no reply being sent.
What layer is responsible for the reply, and are there something that I
should do in the driver initialization to make this work?

Regards,
Johan Russouw

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Wednesday, December 13, 2006 1:22 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] No ARP reply

MS’s “Network Monitor” utility will probably be helpful here as you diagnose
this.

I suspect you have bad checksums in your packets and so the receiving end is
dropping them.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

8

Examine the received packet carefully.

Is the destination Ethernet MAC address correct? Are the Sender and Target
Ethernet addresses correct?

Are you actually seeing an ARP reply? Check carefully because Network
Monitor can cause you to see loopbacks packets. This would mean that Network
Monitor would see the ARP request that you sent as a received packet.

It is best to run Network Monitor on a third machine where it is seeing
packets as they are actually on the wire. Connect all three machines with a
hub - not a switch.

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-272756-
xxxxx@lists.osr.com] On Behalf Of Johan Russouw
Sent: Wednesday, December 13, 2006 7:21 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

Hi
I installed the MS “Network Monitor”. I can see the ARP request packets
being received, but no reply being sent.
What layer is responsible for the reply, and are there something that I
should do in the driver initialization to make this work?

Regards,
Johan Russouw

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Wednesday, December 13, 2006 1:22 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] No ARP reply

MS’s “Network Monitor” utility will probably be helpful here as you
diagnose
this.

I suspect you have bad checksums in your packets and so the receiving end
is
dropping them.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

9

> I installed the MS “Network Monitor”. I can see the ARP request packets

being received, but no reply being sent.
What layer is responsible for the reply

Standard Ethernet ARP within TCPIP.SYS

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

10

Hi
The destination MAC address of the Ethernet packet is *BROADCAST, the sender
address is correct.
The destination IP is correct and the MAC is 00-00-00-00-00-00 of the ARP
request. The sender MAC and IP is correct.

This is for a ping to the computer where my Ethernet device is used.

A previous email mentioned a check sum at the end of the packet. I don’t
have a check sum in my Ethernet packet.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Wednesday, December 13, 2006 3:58 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

Examine the received packet carefully.

Is the destination Ethernet MAC address correct? Are the Sender and Target
Ethernet addresses correct?

Are you actually seeing an ARP reply? Check carefully because Network
Monitor can cause you to see loopbacks packets. This would mean that Network
Monitor would see the ARP request that you sent as a received packet.

It is best to run Network Monitor on a third machine where it is seeing
packets as they are actually on the wire. Connect all three machines with a
hub - not a switch.

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-272756-
xxxxx@lists.osr.com] On Behalf Of Johan Russouw
Sent: Wednesday, December 13, 2006 7:21 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

Hi
I installed the MS “Network Monitor”. I can see the ARP request packets
being received, but no reply being sent.
What layer is responsible for the reply, and are there something that I
should do in the driver initialization to make this work?

Regards,
Johan Russouw

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Wednesday, December 13, 2006 1:22 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] No ARP reply

MS’s “Network Monitor” utility will probably be helpful here as you
diagnose
this.

I suspect you have bad checksums in your packets and so the receiving end
is
dropping them.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

11

The destination MAC address of an ARP REQUEST is broadcast. The
destination MAC address of a REPLY should be directed to the sender of the
ARP request.

The target MAC address would be zero in an ARP REQUEST, but should be a
valid MAC address in an ARP reply.

I still think you may be seeing software loopback of your ARP request…

It is really easy to become confused if your network monitor is running on
the machine you are trying to debug received packets on…

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-272846-
xxxxx@lists.osr.com] On Behalf Of Johan Russouw
Sent: Thursday, December 14, 2006 12:43 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

Hi
The destination MAC address of the Ethernet packet is *BROADCAST, the
sender
address is correct.
The destination IP is correct and the MAC is 00-00-00-00-00-00 of the ARP
request. The sender MAC and IP is correct.

This is for a ping to the computer where my Ethernet device is used.

A previous email mentioned a check sum at the end of the packet. I don’t
have a check sum in my Ethernet packet.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Wednesday, December 13, 2006 3:58 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

Examine the received packet carefully.

Is the destination Ethernet MAC address correct? Are the Sender and Target
Ethernet addresses correct?

Are you actually seeing an ARP reply? Check carefully because Network
Monitor can cause you to see loopbacks packets. This would mean that
Network
Monitor would see the ARP request that you sent as a received packet.

It is best to run Network Monitor on a third machine where it is seeing
packets as they are actually on the wire. Connect all three machines with
a
hub - not a switch.

Thomas F. Divine

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-272756-
> xxxxx@lists.osr.com] On Behalf Of Johan Russouw
> Sent: Wednesday, December 13, 2006 7:21 AM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] No ARP reply
>
> Hi
> I installed the MS “Network Monitor”. I can see the ARP request packets
> being received, but no reply being sent.
> What layer is responsible for the reply, and are there something that I
> should do in the driver initialization to make this work?
>
> Regards,
> Johan Russouw
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@gmail.com
> Sent: Wednesday, December 13, 2006 1:22 AM
> To: Windows System Software Devs Interest List
> Subject: RE:[ntdev] No ARP reply
>
> MS’s “Network Monitor” utility will probably be helpful here as you
> diagnose
> this.
>
> I suspect you have bad checksums in your packets and so the receiving
end
> is
> dropping them.
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

12

The problem is that my computer is not sending back any reply.
It totally ignores the ARP request.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Thursday, December 14, 2006 8:46 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

The destination MAC address of an ARP REQUEST is broadcast. The
destination MAC address of a REPLY should be directed to the sender of the
ARP request.

The target MAC address would be zero in an ARP REQUEST, but should be a
valid MAC address in an ARP reply.

I still think you may be seeing software loopback of your ARP request…

It is really easy to become confused if your network monitor is running on
the machine you are trying to debug received packets on…

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-272846-
xxxxx@lists.osr.com] On Behalf Of Johan Russouw
Sent: Thursday, December 14, 2006 12:43 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

Hi
The destination MAC address of the Ethernet packet is *BROADCAST, the
sender
address is correct.
The destination IP is correct and the MAC is 00-00-00-00-00-00 of the ARP
request. The sender MAC and IP is correct.

This is for a ping to the computer where my Ethernet device is used.

A previous email mentioned a check sum at the end of the packet. I don’t
have a check sum in my Ethernet packet.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Wednesday, December 13, 2006 3:58 PM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

Examine the received packet carefully.

Is the destination Ethernet MAC address correct? Are the Sender and Target
Ethernet addresses correct?

Are you actually seeing an ARP reply? Check carefully because Network
Monitor can cause you to see loopbacks packets. This would mean that
Network
Monitor would see the ARP request that you sent as a received packet.

It is best to run Network Monitor on a third machine where it is seeing
packets as they are actually on the wire. Connect all three machines with
a
hub - not a switch.

Thomas F. Divine

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-272756-
> xxxxx@lists.osr.com] On Behalf Of Johan Russouw
> Sent: Wednesday, December 13, 2006 7:21 AM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] No ARP reply
>
> Hi
> I installed the MS “Network Monitor”. I can see the ARP request packets
> being received, but no reply being sent.
> What layer is responsible for the reply, and are there something that I
> should do in the driver initialization to make this work?
>
> Regards,
> Johan Russouw
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of
> xxxxx@gmail.com
> Sent: Wednesday, December 13, 2006 1:22 AM
> To: Windows System Software Devs Interest List
> Subject: RE:[ntdev] No ARP reply
>
> MS’s “Network Monitor” utility will probably be helpful here as you
> diagnose
> this.
>
> I suspect you have bad checksums in your packets and so the receiving
end
> is
> dropping them.
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

13

Ok. I guess I got it backwards.

Another machine is sending the ARP request to the machine which has the
miniport that you are testing?

Humm…

NetMon sees a valid ARP request being received, but your TCP never generates
a reply.

I am fresh out of ideas here if NetMon has no complaints on the machine that
should be generating the reply.

No, the checksum isn’t an issue. Packets with invalid checksums are tossed
at the hardware level. You would never see a packet with invalid checksum in
Netmon.

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-272851-
xxxxx@lists.osr.com] On Behalf Of Johan Russouw
Sent: Thursday, December 14, 2006 1:55 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

The problem is that my computer is not sending back any reply.
It totally ignores the ARP request.

Regards,
Johan Russouw

Software Development
Data Acquisition Department
Eagle Technology
Tel: +27 21 423 4943
Fax: +27 21 424 4637
www.eagledaq.com
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
Sent: Thursday, December 14, 2006 8:46 AM
To: Windows System Software Devs Interest List
Subject: RE: [ntdev] No ARP reply

The destination MAC address of an ARP REQUEST is broadcast. The
destination MAC address of a REPLY should be directed to the sender of
the
ARP request.

The target MAC address would be zero in an ARP REQUEST, but should be a
valid MAC address in an ARP reply.

I still think you may be seeing software loopback of your ARP request…

It is really easy to become confused if your network monitor is running on
the machine you are trying to debug received packets on…

Thomas F. Divine

> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-272846-
> xxxxx@lists.osr.com] On Behalf Of Johan Russouw
> Sent: Thursday, December 14, 2006 12:43 AM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] No ARP reply
>
> Hi
> The destination MAC address of the Ethernet packet is *BROADCAST, the
> sender
> address is correct.
> The destination IP is correct and the MAC is 00-00-00-00-00-00 of the
ARP
> request. The sender MAC and IP is correct.
>
> This is for a ping to the computer where my Ethernet device is used.
>
> A previous email mentioned a check sum at the end of the packet. I don’t
> have a check sum in my Ethernet packet.
>
> Regards,
> Johan Russouw
>
> Software Development
> Data Acquisition Department
> Eagle Technology
> Tel: +27 21 423 4943
> Fax: +27 21 424 4637
> www.eagledaq.com
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of Thomas F. Divine
> Sent: Wednesday, December 13, 2006 3:58 PM
> To: Windows System Software Devs Interest List
> Subject: RE: [ntdev] No ARP reply
>
> Examine the received packet carefully.
>
> Is the destination Ethernet MAC address correct? Are the Sender and
Target
> Ethernet addresses correct?
>
> Are you actually seeing an ARP reply? Check carefully because Network
> Monitor can cause you to see loopbacks packets. This would mean that
> Network
> Monitor would see the ARP request that you sent as a received packet.
>
> It is best to run Network Monitor on a third machine where it is seeing
> packets as they are actually on the wire. Connect all three machines
with
> a
> hub - not a switch.
>
> Thomas F. Divine
>
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:bounce-272756-
> > xxxxx@lists.osr.com] On Behalf Of Johan Russouw
> > Sent: Wednesday, December 13, 2006 7:21 AM
> > To: Windows System Software Devs Interest List
> > Subject: RE: [ntdev] No ARP reply
> >
> > Hi
> > I installed the MS “Network Monitor”. I can see the ARP request
packets
> > being received, but no reply being sent.
> > What layer is responsible for the reply, and are there something that
I
> > should do in the driver initialization to make this work?
> >
> > Regards,
> > Johan Russouw
> >
> > -----Original Message-----
> > From: xxxxx@lists.osr.com
> > [mailto:xxxxx@lists.osr.com] On Behalf Of
> > xxxxx@gmail.com
> > Sent: Wednesday, December 13, 2006 1:22 AM
> > To: Windows System Software Devs Interest List
> > Subject: RE:[ntdev] No ARP reply
> >
> > MS’s “Network Monitor” utility will probably be helpful here as you
> > diagnose
> > this.
> >
> > I suspect you have bad checksums in your packets and so the receiving
> end
> > is
> > dropping them.
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> > http://www.osronline.com/article.cfm?id=256
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

14

Thomas Divine wrote:

No, the checksum isn’t an issue. Packets with invalid checksums
are tossed at the hardware level. You would never see a packet
with invalid checksum in Netmon.

I’m not sure if we’re talking about the same thing, but Netmon will most certainly show you packets with bad checksums, say at the IP level or higher. It was very useful in debugging my own NDIS driver a while back.

15

Sure,

But the OP has consistently said ARP which does not have an (application or
‘L3’) checksum.

Out of curiosity, just what is the OP’s NIC/Miniport reporting for
OID_802_3_CURRENT_ADDRESS and OID_802_3_PERMENANT_ADDRESS? Hopefully it is
not 00-00-00-00-00-00 …

Dave Cattley
Consulting Engineer
Systems Software Development

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of
xxxxx@gmail.com
Sent: Thursday, December 14, 2006 7:25 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] No ARP reply

Thomas Divine wrote:

No, the checksum isn’t an issue. Packets with invalid checksums are
tossed at the hardware level. You would never see a packet with
invalid checksum in Netmon.

I’m not sure if we’re talking about the same thing, but Netmon will most
certainly show you packets with bad checksums, say at the IP level or
higher. It was very useful in debugging my own NDIS driver a while back.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

16

OP was talking about “the checksum at the end”. That would be the Ethernet
checksum.

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-272880-
xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Thursday, December 14, 2006 7:25 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] No ARP reply

Thomas Divine wrote:

> No, the checksum isn’t an issue. Packets with invalid checksums
> are tossed at the hardware level. You would never see a packet
> with invalid checksum in Netmon.

I’m not sure if we’re talking about the same thing, but Netmon will most
certainly show you packets with bad checksums, say at the IP level or
higher. It was very useful in debugging my own NDIS driver a while back.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer