Re: problem with NdisReturnPackets ( )

Steve wrote:
> If you queue the packets then you must alloc and copy the
> payload.

This is not required. You can queue original packets until their
payload is no longer in use by the IM. You can also use the original
NDIS_PACKET descriptor if you use packet stacking.

Without packet stacking, a new NDIS_PACKET descriptor (allocated by the
IM) must be used. But its NDIS_BUFFER list can be the same as the one
used by the original NDIS_PACKET.

IIRC, PASSTHRU does exactly this, i.e. it does not copy the payload
*unless* it needs to *modify* the payload.

That is, the original payload must not, under no circumstances, be
modified. It is read-only to the IM. But you can have your own
NDIS_BUFFER list that points to your own payload, e.g. the MAC header.
Then use your own NDIS_BUFFER (or buffers) to point the original
payload. This way, parts of the original payload can be replaced
without having to copy the actual payload data.

> The passthru example just allocs and copies the
> packet descriptor and sets the desriptor to point to the
> payload in the original packet descriptor.

Yup.

> My quess (and
> I mean guess) is that the payload is being freed by the
> NIC (receive) while the copied packet is still in your
> queue.

How can the NIC free any NDIS_PACKET, NDIS_BUFFER, or payload before
the NDIS_PACKET is being returned to it? That would be a programming
fault and I seriously doubt it since the OP says he sees the problem in
more tha one configuration (ie.e with different miniport drivers).

Also, the NDIS Test tool (see my article at
http://www.microsoft.com/whdc/resources/mvp/SW-MVP.mspx) would for sure
detect such misbehaviour.

Stephan

.

Relevant Pages

  • RE: Packet Payload
    ... storage you would need and if it would cause a packet loss issue. ... concerned about then I would really look a doing some sort of capture. ... Subject: Packet Payload ... Cenzic Hailstorm finds vulnerabilities fast. ...
    (Pen-Test)
  • Re: Packet Manipulation advice request.
    ... > payload of a known UDP packet. ... not sure whether IPTables could be used. ... > will manipulate the payload of the packet by replacing current padding ...
    (comp.os.linux.networking)
  • Re: Packet Manipulation advice request.
    ... > payload of a known UDP packet. ... not sure whether IPTables could be used. ... > will manipulate the payload of the packet by replacing current padding ...
    (comp.os.linux.security)
  • Re: Should I be concerned about?
    ... snort -- snort has the capability to parse the payload of Destination ... Type:3 Code:13 DESTINATION UNREACHABLE: PACKET FILTERED ... > send data to a trojan (listening for ICMP traffic on the target machine)? ...
    (Incidents)
  • Re: passthru help
    ... Instead, allocate your own area ... patch the NDIS_BUFFER chain of your packet to include this buffer. ... Miniportsendpacket fucntion and able to retrive payload and just try to pass ... memcpy(pNewPayload, // Copy ethernet header, IP header and ...
    (microsoft.public.development.device.drivers)