Re: Can a TDI Filter Driver get Headers and Frame Details of localhost packets ?

He said in his first message , “localhost IRP” . So I thinked tcpip
loopback. I might be wrong ofcourse, he should say clearly what he wants to
do.

Dan

----- Original Message -----
From: “Dave McCowan”
To: “NT Developers Interest List”
Sent: Monday, July 22, 2002 5:45 PM
Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame Details
of localhost packets ?

> I think Subodh may be thinking of the MS loopback adapter; the tool used
to test
> network aware applications in absence of a network card.
>
> Dan Partelly wrote:
>
> > Hi,
> >
> > If I recall right the loopback mechanism for localhost trafic is
internal to
> > TCPIP driver. Packets are not passed to NDIS for reflection. So if you
want
> > to monitor trafic on sockets used as a local IPC mechanism, connecting
to
> > localhost, you need TDI level. I think that coneccting to NIC adapter IP
> > address will result in NDIS loopback behaviour only.
> >
> > At TDI level filtering, you have no access to IP headers , anyway.
> >
> > Maybe somone at MS can confirm this, I dont recall all details.
> >
> > Dan
> >
> > ----- Original Message -----
> > From: “Subodh Gupta”
> > To: “NT Developers Interest List”
> > Sent: Monday, July 22, 2002 3:55 PM
> > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
Details
> > of localhost packets ?
> >
> > > Hi,
> > >
> > > I think the biggest confusion here is about where exactly the LOOPBACK
> > > feature is implemented ??
> > >
> > > DDK documentation says that it is inside NDIS library {for the
hardware
> > > which does not have loopback implemented in it} but you say that it
is in
> > > TCP ??
> > >
> > > if it is in TCP then I am filtering the right thing so i must get the
> > > details (atleast for reflected packets).
> > >
> > > if NDIS is looping back then a filter {which will now be known as
> > > Intermediate driver} should sit below tcp and above NDIS.
> > >
> > > Pls clear the confusion…
> > > thanks in advance…
> > > --Subodh
> > >
> > >
> > > ----- Original Message -----
> > > From: “Dan Partelly”
> > > To: “NT Developers Interest List”
> > > Sent: Monday, July 22, 2002 3:37 PM
> > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
Details
> > > of localhost packets ?
> > >
> > >
> > > > 4->is it possible for me to see the header details of those IRP’s ?
I
> > know
> > > > that probably not in case of outgoing IRP’s but what about Incoming
> > IRP’s
> > > > which are sent back by NDIS and TCP as a result of loopback ??
> > > >
> > > > Im afarid it does not work this way. the loopback mechanism is
> > implemented
> > > > internal to tcpip driver. And anyway,
> > > > NDIS wont talk to protocol drivers through IRPs.
> > > >
> > > > Dan
> > > >
> > > > ----- Original Message -----
> > > > From: “Subodh Gupta”
> > > > To: “NT Developers Interest List”
> > > > Sent: Monday, July 22, 2002 12:18 PM
> > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
> > Details
> > > > of localhost packets ?
> > > >
> > > >
> > > > > Hi Friends,
> > > > >
> > > > > I think i need to make it some more clear -
> > > > >
> > > > > 1-> What i am doing is i have created a filter driver which sits
above
> > > the
> > > > > TCP.SYS and monitors all the incoming and outgoing traffic.
> > > > >
> > > > > 2-> since i am watching all the IRP’s so my question is regarding
> > > specific
> > > > > loopback and localhost IRP.
> > > > > 3-> I am also hooking the events.
> > > > > 4->is it possible for me to see the header details of those IRP’s
? I
> > > know
> > > > > that probably not in case of outgoing IRP’s but what about
Incoming
> > > IRP’s
> > > > > which are sent back by NDIS and TCP as a result of loopback ??
> > > > >
> > > > > I think this makes clear what i mean to say.
> > > > >
> > > > > — Subodh
> > > > > ----- Original Message -----
> > > > > From: “Dan Partelly”
> > > > > Newsgroups: ntdev
> > > > > To: “NT Developers Interest List”
> > > > > Sent: Sunday, July 21, 2002 4:45 PM
> > > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
> > > Details
> > > > > of localhost packets ?
> > > > >
> > > > >
> > > > > > >> would try doing a filter driver for the tcp DriverObject.
> > > > > >
> > > > > > Wont work. And officially you cant filter “driver objects”, only
> > > device
> > > > > > objects. Hooking directly the dispatch
> > > > > > points in the driver object is not supported by MS. And anyway,
> > access
> > > > to
> > > > > IP
> > > > > > header is not available for a
> > > > > > filter driver, layered above any of the TCP device objects. You
can,
> > > > > > however, identify data which is targeted
> > > > > > against 127.0.0.1, but not by peeking the IP frame.
> > > > > >
> > > > > > >> I would try to do a filter for tcpip.sys and look at the
> > packets.
> > > > > >
> > > > > > >> TDI is the Transfer Device Interface
> > > > > >
> > > > > > Actually, its Transport Driver Interface. And has nothing to do
with
> > > > > > winsockets and routing through sockets.
> > > > > >
> > > > > > Dan
> > > > > >
> > > > > > “William Michael Jones” wrote in
message
> > > > > > news:xxxxx@ntdev…
> > > > > > >
> > > > > > > I would try doing a filter driver for the tcp DriverObject.
Note
> > > that
> > > > > > > tcpip.sys has tcpip, upd and other Driverobject in it. Do
!Drvobj
> > > > > > > tcpip.sys in NT. I would try to do a filter for tcpip.sys and
> > look
> > > at
> > > > > > > the packets.
> > > > > > >
> > > > > > >
> > > > > > > TDI is the Transfer Device Interface that routes the packets
to
> > the
> > > > > > > correct driver by way of the Winsocket dll.
> > > > > > >
> > > > > > > I have not done this but it might help.
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > —
> > > > > > You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > >
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> > > > To unsubscribe send a blank email to %%email.unsub%%
> > > >
> > >
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@okena.com
> > To unsubscribe send a blank email to %%email.unsub%%
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> To unsubscribe send a blank email to %%email.unsub%%
>

Hi All,
yes Dan, my question was regarding localhost IRP’s.
But what exactly do you mean when you say -

I think that coneccting to NIC adapter IP
address will result in NDIS loopback behaviour only.

Which behaviours is this ? isnt is the same as i was talking about in the
last mail that NDIS loops back packets??

–Subodh

----- Original Message -----
From: “Dan Partelly”
To: “NT Developers Interest List”
Sent: Monday, July 22, 2002 8:10 PM
Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame Details
of localhost packets ?

> He said in his first message , “localhost IRP” . So I thinked tcpip
> loopback. I might be wrong ofcourse, he should say clearly what he wants
to
> do.
>
> Dan
>
>
>
> ----- Original Message -----
> From: “Dave McCowan”
> To: “NT Developers Interest List”
> Sent: Monday, July 22, 2002 5:45 PM
> Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame Details
> of localhost packets ?
>
>
> > I think Subodh may be thinking of the MS loopback adapter; the tool used
> to test
> > network aware applications in absence of a network card.
> >
> > Dan Partelly wrote:
> >
> > > Hi,
> > >
> > > If I recall right the loopback mechanism for localhost trafic is
> internal to
> > > TCPIP driver. Packets are not passed to NDIS for reflection. So if you
> want
> > > to monitor trafic on sockets used as a local IPC mechanism, connecting
> to
> > > localhost, you need TDI level. I think that coneccting to NIC adapter
IP
> > > address will result in NDIS loopback behaviour only.
> > >
> > > At TDI level filtering, you have no access to IP headers , anyway.
> > >
> > > Maybe somone at MS can confirm this, I dont recall all details.
> > >
> > > Dan
> > >
> > > ----- Original Message -----
> > > From: “Subodh Gupta”
> > > To: “NT Developers Interest List”
> > > Sent: Monday, July 22, 2002 3:55 PM
> > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
> Details
> > > of localhost packets ?
> > >
> > > > Hi,
> > > >
> > > > I think the biggest confusion here is about where exactly the
LOOPBACK
> > > > feature is implemented ??
> > > >
> > > > DDK documentation says that it is inside NDIS library {for the
> hardware
> > > > which does not have loopback implemented in it} but you say that it
> is in
> > > > TCP ??
> > > >
> > > > if it is in TCP then I am filtering the right thing so i must get
the
> > > > details (atleast for reflected packets).
> > > >
> > > > if NDIS is looping back then a filter {which will now be known as
> > > > Intermediate driver} should sit below tcp and above NDIS.
> > > >
> > > > Pls clear the confusion…
> > > > thanks in advance…
> > > > --Subodh
> > > >
> > > >
> > > > ----- Original Message -----
> > > > From: “Dan Partelly”
> > > > To: “NT Developers Interest List”
> > > > Sent: Monday, July 22, 2002 3:37 PM
> > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
> Details
> > > > of localhost packets ?
> > > >
> > > >
> > > > > 4->is it possible for me to see the header details of those IRP’s
?
> I
> > > know
> > > > > that probably not in case of outgoing IRP’s but what about
Incoming
> > > IRP’s
> > > > > which are sent back by NDIS and TCP as a result of loopback ??
> > > > >
> > > > > Im afarid it does not work this way. the loopback mechanism is
> > > implemented
> > > > > internal to tcpip driver. And anyway,
> > > > > NDIS wont talk to protocol drivers through IRPs.
> > > > >
> > > > > Dan
> > > > >
> > > > > ----- Original Message -----
> > > > > From: “Subodh Gupta”
> > > > > To: “NT Developers Interest List”
> > > > > Sent: Monday, July 22, 2002 12:18 PM
> > > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
> > > Details
> > > > > of localhost packets ?
> > > > >
> > > > >
> > > > > > Hi Friends,
> > > > > >
> > > > > > I think i need to make it some more clear -
> > > > > >
> > > > > > 1-> What i am doing is i have created a filter driver which sits
> above
> > > > the
> > > > > > TCP.SYS and monitors all the incoming and outgoing traffic.
> > > > > >
> > > > > > 2-> since i am watching all the IRP’s so my question is
regarding
> > > > specific
> > > > > > loopback and localhost IRP.
> > > > > > 3-> I am also hooking the events.
> > > > > > 4->is it possible for me to see the header details of those
IRP’s
> ? I
> > > > know
> > > > > > that probably not in case of outgoing IRP’s but what about
> Incoming
> > > > IRP’s
> > > > > > which are sent back by NDIS and TCP as a result of loopback ??
> > > > > >
> > > > > > I think this makes clear what i mean to say.
> > > > > >
> > > > > > — Subodh
> > > > > > ----- Original Message -----
> > > > > > From: “Dan Partelly”
> > > > > > Newsgroups: ntdev
> > > > > > To: “NT Developers Interest List”
> > > > > > Sent: Sunday, July 21, 2002 4:45 PM
> > > > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and
Frame
> > > > Details
> > > > > > of localhost packets ?
> > > > > >
> > > > > >
> > > > > > > >> would try doing a filter driver for the tcp DriverObject.
> > > > > > >
> > > > > > > Wont work. And officially you cant filter “driver objects”,
only
> > > > device
> > > > > > > objects. Hooking directly the dispatch
> > > > > > > points in the driver object is not supported by MS. And
anyway,
> > > access
> > > > > to
> > > > > > IP
> > > > > > > header is not available for a
> > > > > > > filter driver, layered above any of the TCP device objects.
You
> can,
> > > > > > > however, identify data which is targeted
> > > > > > > against 127.0.0.1, but not by peeking the IP frame.
> > > > > > >
> > > > > > > >> I would try to do a filter for tcpip.sys and look at the
> > > packets.
> > > > > > >
> > > > > > > >> TDI is the Transfer Device Interface
> > > > > > >
> > > > > > > Actually, its Transport Driver Interface. And has nothing to
do
> with
> > > > > > > winsockets and routing through sockets.
> > > > > > >
> > > > > > > Dan
> > > > > > >
> > > > > > > “William Michael Jones” wrote in
> message
> > > > > > > news:xxxxx@ntdev…
> > > > > > > >
> > > > > > > > I would try doing a filter driver for the tcp DriverObject.
> Note
> > > > that
> > > > > > > > tcpip.sys has tcpip, upd and other Driverobject in it. Do
> !Drvobj
> > > > > > > > tcpip.sys in NT. I would try to do a filter for tcpip.sys
and
> > > look
> > > > at
> > > > > > > > the packets.
> > > > > > > >
> > > > > > > >
> > > > > > > > TDI is the Transfer Device Interface that routes the packets
> to
> > > the
> > > > > > > > correct driver by way of the Winsocket dll.
> > > > > > > >
> > > > > > > > I have not done this but it might help.
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > —
> > > > > > > You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> > > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > —
> > > > > > You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > >
> > > >
> > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> > > > To unsubscribe send a blank email to %%email.unsub%%
> > > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@okena.com
> > > To unsubscribe send a blank email to %%email.unsub%%
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> To unsubscribe send a blank email to %%email.unsub%%
>

say you have an NIC adapter in your machine with IP xxx.xxx.xxx.xxx , and
you use its IP.

127.0.0.1 is local host , another animal.

“Subodh Gupta” wrote in message news:xxxxx@ntdev…
>
> Hi All,
> yes Dan, my question was regarding localhost IRP’s.
> But what exactly do you mean when you say -
>
> >I think that coneccting to NIC adapter IP
> >address will result in NDIS loopback behaviour only.
>
> Which behaviours is this ? isnt is the same as i was talking about in the
> last mail that NDIS loops back packets??
>
> --Subodh
>
>
>
> ----- Original Message -----
> From: “Dan Partelly”
> To: “NT Developers Interest List”
> Sent: Monday, July 22, 2002 8:10 PM
> Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame Details
> of localhost packets ?
>
>
> > He said in his first message , “localhost IRP” . So I thinked tcpip
> > loopback. I might be wrong ofcourse, he should say clearly what he wants
> to
> > do.
> >
> > Dan
> >
> >
> >
> > ----- Original Message -----
> > From: “Dave McCowan”
> > To: “NT Developers Interest List”
> > Sent: Monday, July 22, 2002 5:45 PM
> > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
Details
> > of localhost packets ?
> >
> >
> > > I think Subodh may be thinking of the MS loopback adapter; the tool
used
> > to test
> > > network aware applications in absence of a network card.
> > >
> > > Dan Partelly wrote:
> > >
> > > > Hi,
> > > >
> > > > If I recall right the loopback mechanism for localhost trafic is
> > internal to
> > > > TCPIP driver. Packets are not passed to NDIS for reflection. So if
you
> > want
> > > > to monitor trafic on sockets used as a local IPC mechanism,
connecting
> > to
> > > > localhost, you need TDI level. I think that coneccting to NIC
adapter
> IP
> > > > address will result in NDIS loopback behaviour only.
> > > >
> > > > At TDI level filtering, you have no access to IP headers , anyway.
> > > >
> > > > Maybe somone at MS can confirm this, I dont recall all details.
> > > >
> > > > Dan
> > > >
> > > > ----- Original Message -----
> > > > From: “Subodh Gupta”
> > > > To: “NT Developers Interest List”
> > > > Sent: Monday, July 22, 2002 3:55 PM
> > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
> > Details
> > > > of localhost packets ?
> > > >
> > > > > Hi,
> > > > >
> > > > > I think the biggest confusion here is about where exactly the
> LOOPBACK
> > > > > feature is implemented ??
> > > > >
> > > > > DDK documentation says that it is inside NDIS library {for the
> > hardware
> > > > > which does not have loopback implemented in it} but you say that
it
> > is in
> > > > > TCP ??
> > > > >
> > > > > if it is in TCP then I am filtering the right thing so i must get
> the
> > > > > details (atleast for reflected packets).
> > > > >
> > > > > if NDIS is looping back then a filter {which will now be known as
> > > > > Intermediate driver} should sit below tcp and above NDIS.
> > > > >
> > > > > Pls clear the confusion…
> > > > > thanks in advance…
> > > > > --Subodh
> > > > >
> > > > >
> > > > > ----- Original Message -----
> > > > > From: “Dan Partelly”
> > > > > To: “NT Developers Interest List”
> > > > > Sent: Monday, July 22, 2002 3:37 PM
> > > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame
> > Details
> > > > > of localhost packets ?
> > > > >
> > > > >
> > > > > > 4->is it possible for me to see the header details of those
IRP’s
> ?
> > I
> > > > know
> > > > > > that probably not in case of outgoing IRP’s but what about
> Incoming
> > > > IRP’s
> > > > > > which are sent back by NDIS and TCP as a result of loopback ??
> > > > > >
> > > > > > Im afarid it does not work this way. the loopback mechanism is
> > > > implemented
> > > > > > internal to tcpip driver. And anyway,
> > > > > > NDIS wont talk to protocol drivers through IRPs.
> > > > > >
> > > > > > Dan
> > > > > >
> > > > > > ----- Original Message -----
> > > > > > From: “Subodh Gupta”
> > > > > > To: “NT Developers Interest List”
> > > > > > Sent: Monday, July 22, 2002 12:18 PM
> > > > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and
Frame
> > > > Details
> > > > > > of localhost packets ?
> > > > > >
> > > > > >
> > > > > > > Hi Friends,
> > > > > > >
> > > > > > > I think i need to make it some more clear -
> > > > > > >
> > > > > > > 1-> What i am doing is i have created a filter driver which
sits
> > above
> > > > > the
> > > > > > > TCP.SYS and monitors all the incoming and outgoing traffic.
> > > > > > >
> > > > > > > 2-> since i am watching all the IRP’s so my question is
> regarding
> > > > > specific
> > > > > > > loopback and localhost IRP.
> > > > > > > 3-> I am also hooking the events.
> > > > > > > 4->is it possible for me to see the header details of those
> IRP’s
> > ? I
> > > > > know
> > > > > > > that probably not in case of outgoing IRP’s but what about
> > Incoming
> > > > > IRP’s
> > > > > > > which are sent back by NDIS and TCP as a result of loopback ??
> > > > > > >
> > > > > > > I think this makes clear what i mean to say.
> > > > > > >
> > > > > > > — Subodh
> > > > > > > ----- Original Message -----
> > > > > > > From: “Dan Partelly”
> > > > > > > Newsgroups: ntdev
> > > > > > > To: “NT Developers Interest List”
> > > > > > > Sent: Sunday, July 21, 2002 4:45 PM
> > > > > > > Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and
> Frame
> > > > > Details
> > > > > > > of localhost packets ?
> > > > > > >
> > > > > > >
> > > > > > > > >> would try doing a filter driver for the tcp
DriverObject.
> > > > > > > >
> > > > > > > > Wont work. And officially you cant filter “driver objects”,
> only
> > > > > device
> > > > > > > > objects. Hooking directly the dispatch
> > > > > > > > points in the driver object is not supported by MS. And
> anyway,
> > > > access
> > > > > > to
> > > > > > > IP
> > > > > > > > header is not available for a
> > > > > > > > filter driver, layered above any of the TCP device objects.
> You
> > can,
> > > > > > > > however, identify data which is targeted
> > > > > > > > against 127.0.0.1, but not by peeking the IP frame.
> > > > > > > >
> > > > > > > > >> I would try to do a filter for tcpip.sys and look at the
> > > > packets.
> > > > > > > >
> > > > > > > > >> TDI is the Transfer Device Interface
> > > > > > > >
> > > > > > > > Actually, its Transport Driver Interface. And has nothing to
> do
> > with
> > > > > > > > winsockets and routing through sockets.
> > > > > > > >
> > > > > > > > Dan
> > > > > > > >
> > > > > > > > “William Michael Jones” wrote in
> > message
> > > > > > > > news:xxxxx@ntdev…
> > > > > > > > >
> > > > > > > > > I would try doing a filter driver for the tcp
DriverObject.
> > Note
> > > > > that
> > > > > > > > > tcpip.sys has tcpip, upd and other Driverobject in it. Do
> > !Drvobj
> > > > > > > > > tcpip.sys in NT. I would try to do a filter for tcpip.sys
> and
> > > > look
> > > > > at
> > > > > > > > > the packets.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > > TDI is the Transfer Device Interface that routes the
packets
> > to
> > > > the
> > > > > > > > > correct driver by way of the Winsocket dll.
> > > > > > > > >
> > > > > > > > > I have not done this but it might help.
> > > > > > > > >
> > > > > > > > >
> > > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > >
> > > > > > > > —
> > > > > > > > You are currently subscribed to ntdev as:
xxxxx@leadbyte.com
> > > > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > > > >
> > > > > > >
> > > > > > >
> > > > > > >
> > > > > > > —
> > > > > > > You are currently subscribed to ntdev as:
xxxxx@rdsor.ro
> > > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > > —
> > > > > > You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> > > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > > >
> > > > >
> > > > >
> > > > >
> > > > > —
> > > > > You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> > > > > To unsubscribe send a blank email to %%email.unsub%%
> > > > >
> > > >
> > > > —
> > > > You are currently subscribed to ntdev as: xxxxx@okena.com
> > > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> > >
> > > —
> > > You are currently subscribed to ntdev as: xxxxx@rdsor.ro
> > > To unsubscribe send a blank email to %%email.unsub%%
> > >
> >
> >
> >
> > —
> > You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> > To unsubscribe send a blank email to %%email.unsub%%
> >
>
>
>
>

Hi guys!

I slightly missed your discussion but anyway I suppose there’s only way to
catch loopback IP packets with the whole header details. It’s a Filter-Hook
Driver (see IOCTL_PF_SET_EXTENSION_POINTER in DDK).

Isn’t it?

Hi All,
yes Dan, my question was regarding localhost IRP’s.
But what exactly do you mean when you say -

>I think that coneccting to NIC adapter IP
>address will result in NDIS loopback behaviour only.

Which behaviours is this ? isnt is the same as i was talking about in the
last mail that NDIS loops back packets??

–Subodh

Hi ,
Probably you are right as it seems to be like that in documentation also but
i am not sure that is the right place to hook.
Because DDK clearly says that OS only allows one filter hook driver for the
system. In this case what will happen when some one else has installed some
filter hook and tries to install and use my application ???

This is the biggest problem with Hooks.So i must do it either using IM
driver or filter driver.

what do u think …?

— Subodh

----- Original Message -----
From: “vlad-ntdev”
To: “NT Developers Interest List”
Sent: Tuesday, July 23, 2002 4:49 PM
Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame Details
of localhost packets ?

> Hi guys!
>
> I slightly missed your discussion but anyway I suppose there’s only way to
> catch loopback IP packets with the whole header details. It’s a
Filter-Hook
> Driver (see IOCTL_PF_SET_EXTENSION_POINTER in DDK).
>
> Isn’t it?
>
> > Hi All,
> > yes Dan, my question was regarding localhost IRP’s.
> > But what exactly do you mean when you say -
> >
> > >I think that coneccting to NIC adapter IP
> > >address will result in NDIS loopback behaviour only.
> >
> > Which behaviours is this ? isnt is the same as i was talking about in
the
> > last mail that NDIS loops back packets??
> >
> > --Subodh
>
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> To unsubscribe send a blank email to %%email.unsub%%
>

> Hi ,

Probably you are right as it seems to be like that in documentation also
but
i am not sure that is the right place to hook.
Because DDK clearly says that OS only allows one filter hook driver for
the
system. In this case what will happen when some one else has installed
some
filter hook and tries to install and use my application ???

This is the biggest problem with Hooks.So i must do it either using IM
driver or filter driver.

Is the speach still about loopback interface? I told that hooks seems to be
the only way to get IP packets on loopback interface.

what do u think …?

:slight_smile: I think that if IOCTL_PF_SET_EXTENSION_POINTER gave us access to
previous hook we would call it in a chain and there’s no problem would be.
(poor english, sorry)

vlad-ntdev

Hi,
Yes speech was about loopback interface…
–Subodh
----- Original Message -----
From: “vlad-ntdev”
To: “NT Developers Interest List”
Sent: Tuesday, July 23, 2002 5:56 PM
Subject: [ntdev] Re: Can a TDI Filter Driver get Headers and Frame Details
of localhost packets ?

> > Hi ,
> > Probably you are right as it seems to be like that in documentation also
> but
> > i am not sure that is the right place to hook.
> > Because DDK clearly says that OS only allows one filter hook driver for
> the
> > system. In this case what will happen when some one else has installed
> some
> > filter hook and tries to install and use my application ???
> >
> > This is the biggest problem with Hooks.So i must do it either using IM
> > driver or filter driver.
>
> Is the speach still about loopback interface? I told that hooks seems to
be
> the only way to get IP packets on loopback interface.
>
> >
> > what do u think …?
> >
>
> :slight_smile: I think that if IOCTL_PF_SET_EXTENSION_POINTER gave us access to
> previous hook we would call it in a chain and there’s no problem would be.
> (poor english, sorry)
>
> vlad-ntdev
>
>
>
>
> —
> You are currently subscribed to ntdev as: xxxxx@leadbyte.com
> To unsubscribe send a blank email to %%email.unsub%%
>