Re: How to set NIC to promiscuous mode from FilterHook driver

I did not understand exactly what your component is. "Filter hook driver" could mean one of those nasty virus like drivers that take a shortcut by hijacking NDIS and TCPIP entry points. It could also mean an NDIS IM filter (or lightweight filter for NDIS 6 and higher) drivers written to spec or it could be something else. If your driver is hijacking NDIS/TCPIP entry points, please disregard my mail. Unfortunately many people on this newsgroup will help you nevertheless. I can't.

If your object is to see packets sent to the other interfaces on the network -from- this machine, then just look at them on the transmit path.

If you want to see packets sent to the other interfaces connected to the same switch then read on.

You set a NIC to promiscuous mode by sending a set_packet_filter OID to the NIC. (you need to be a NDIS protocol or lightweight driver to do this ). But that will not help you. Any switch worth the box it came in, will not allow you to see "packets destined to other machines in the network" just because you set the NIC to promiscuous mode (with the exception of being connected to a "mirror" port).

-ali

--
This posting is provided "AS IS" with no warranties, and confers no rights.

<vasantharaj.g@xxxxxxxxxxxxx> wrote in message news:e37c994c-0a95-45bb-9e25-b0f59256a490@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hi !

I want to receive all packets in my filter hook driver and do
filtering the TCP packets which matches a particular destination
address in the network. So, I wrote a filter hook driver and is
working fine. Now, I want to get packets destined to other machines
also in the network, from my filter hook driver. How can I set the NIC
to promiscuous mode so that I shall receive other packets also in my
PacketFilterExtension function.

Is it possible? If so, how can I set it?

Please help.

thanks in advance,

regards,
vasanth.

.

Relevant Pages

  • Re: How to set NIC to promiscuous mode from FilterHook driver
    ... the filter hook driver I mentioned is as per the msdn ... able to get packets to an fro the host machine. ... hijacking NDIS and TCPIP entry points. ... network -from- this machine, then just look at them on the transmit path.. ...
    (microsoft.public.development.device.drivers)
  • Re: How to set NIC to promiscuous mode from FilterHook driver
    ... So from your reply I take it you are interested in getting packets destined to other hosts -that are not necessarily originated from the host your filter is running on-. ... As I said in my previous post, setting the adapter to promiscuous mode is not going to help you. ... the filter hook driver I mentioned is as per the msdn ...
    (microsoft.public.development.device.drivers)
  • How to set NIC to promiscuous mode from FilterHook driver
    ... I want to receive all packets in my filter hook driver and do ... filtering the TCP packets which matches a particular destination ... also in the network, ...
    (microsoft.public.development.device.drivers)
  • RE: How to set NIC to promiscuous mode from FilterHook driver
    ... Add NDIS_PACKET_TYPE_PROMISCUOUS to your filter to support promiscuous mode ... Best regards, ... I want to receive all packets in my filter hook driver and do ...
    (microsoft.public.development.device.drivers)
  • RE: Packet to process ID mapping in filter-hook driver.
    ... you are trying to get the process identifier from your IP filter ... IP filter hook driver, it does not need to know which process sent these packets. ... there is no rfc for PID information of a packet. ...
    (microsoft.public.win32.programmer.kernel)
Loading