Re: Problem with matching kind of NDIS driver.

"mirage2k2" <mirage2k2@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:E5F3B882-1DD7-45A2-909D-97DC4E02FECD@xxxxxxxxxxxxxxxx
With TDI driver and NDIS IM you can match traffic to PID via port number
only. What does your driver really need to do? If you need to queue

That is them of my Master of Science Job, I have to find a way how to solve
that problem on NDIS driver layer.

packets then you must use NDIS IM driver. If you just want to
sniff/modify packets then there are some other options, i.e. filter
hook, etc. Note also that you will not see any packets in the TDI
driver, rather you see IOCTRLs for operations such as connect, send,
receive, etc. Filtering such commands will allow you to obtain
PID/TID, port numbers and for some, remote ip addresses. Mirage2k2

I need a driver which will catch all packets going through network card,
find PID's for that, and sends all the informations for application on users
layer (that application will be logging all network activieties - it has to
work as the "netstat -anb" application but in real time). Thanks for your
advices, Mirage2k2.

--
With regards
thanks,
Witek


.

Relevant Pages

  • RE: Test on 10GBE Intel based network card
    ... Test on 10GBE Intel based network card ... Also, I thought you were using the current driver, but now it looks like you are ... The limitation that you see is about the max number of packets that ... 1/ the card's interrupts are probably attache dto aonly 1 cpu, ...
    (freebsd-performance)
  • Re: Filter Hook
    ... the callback routine is been invoked at DISPATCH_LEVEL. ... If you really have to keep such a queue for the packets, then the IP filter driver is not suitable for your needs since you have to process all the packets in the callback routine without any wait actionand return it to the tcpip driver immediately when the callback routine returns. ... What IRQL are you running at when you crash, ...
    (microsoft.public.development.device.drivers)
  • Writing protocol driver for Raw Packet bridging
    ... catching all packets on one network card and passing it to a second ... But the next step requires commenting out a mac address check (anti- ... // Comment out to support sending packets from any MAC source address ... directly access an NDIS miniport driver. ...
    (microsoft.public.windowsce.platbuilder)
  • Re: MAC bridging and sniffing packets with specific Ethertype
    ... That is, the Ethernet adapters are bound to the Mbridge driver (which, since ... Mbridge handles the bridging of packets between the adapters. ...
    (microsoft.public.windowsce.embedded)
  • Re: Test on 10GBE Intel based network card
    ... Who ya gonna call, why me of course, its my driver:) ... ix0: ... Driver dropped packets = 0 ... ix1: ...
    (freebsd-performance)