Question about filtering native wireless

NTDEV
1

I’m developing an NDIS 6 filter driver to inspect packet contents.

The sample NDIS filter in the WDK only binds miniports with a media type of NdisMedium802_3 and in particular, it rejects binds to type NdisMediumNative802_11 for wireless adapters.

I can observe the attach fail on the first connection to the wireless adapter to be followed by a second attach to the same device, this time with the medium set to NdisMedium802_3 which succeeds.

I suspect that the behavior relates to the Microsoft’s “native wifi” filter.

Should a content filter that wants to inspect wireless traffic accept the initial bind?
What does the “native wifi” filter actually do?

2

You can use a monitoring NDIS 6 LWF to inspect Native Wi-Fi. A monitoring filter can bind above and below the Microsoft Native Wi-Fi LWF.

However, Microsoft has designed their Native-Wi-Fi so no third-party modifying filter can bind directly to the actual Native Wi-Fi NIC miniport.

The Microsoft component performs LAN emulation (LANE) among other connection and authentication tasks. At the top-edge the Microsoft Native Wi-Fi filter presents a virtual 802.3 adapter to higher-level protocols.

Good luck,

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-312512-
xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com
Sent: Wednesday, January 23, 2008 10:33 PM
To: Windows System Software Devs Interest List
Subject: [ntdev] Question about filtering native wireless

I�m developing an NDIS 6 filter driver to inspect packet contents.

The sample NDIS filter in the WDK only binds miniports with a media
type of NdisMedium802_3 and in particular, it rejects binds to type
NdisMediumNative802_11 for wireless adapters.

I can observe the attach fail on the first connection to the wireless
adapter to be followed by a second attach to the same device, this time
with the medium set to NdisMedium802_3 which succeeds.

I suspect that the behavior relates to the Microsoft�s �native wifi�
filter.

Should a content filter that wants to inspect wireless traffic accept
the initial bind?
What does the �native wifi� filter actually do?

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer