helper drivers and PPPoe connection

[beggar]

I am using windows 7 64 bit. I already created a test signed copy of the ndisrd.sys file. and installed it. Do I have to create test signed copies of the ndisrd.inf and the ndisrd_m files as well?

Also I have a dial up PPPoe connection going to my Lan. I was able to install the winpkfilter drive on all of my wireless and ethernet lan adapters, but the PPPoe wan miniport connection would not take the driver. I was wondering if it is suppoed to be on that connection or just the ethernet adapter it is plugged into.

Below is a copy of my Ipconfig

Windows IP Configuration

Host Name . . . . . . . . . . . . : Marc-Antony-PC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-4A-27-DF-42
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::b997:e84c:c749:262b%67(Preferred)
IPv4 Address. . . . . . . . . . . : 172.16.1.1(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 1224802122
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-5A-4E-F3-00-1C-23-94-3E-23

DNS Servers . . . . . . . . . . . : 212.31.224.2
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Bluetooth Network Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Bluetooth Device (Personal Area Network)
Physical Address. . . . . . . . . : 00-1C-26-DE-9A-AC
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/Wireless 3945ABG Network Con
nection
Physical Address. . . . . . . . . : 00-1C-BF-23-8B-3A
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::f5cf:2d36:f55e:f20b%12(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.26(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Thursday, April 29, 2010 7:48:40 AM
Lease Expires . . . . . . . . . . : Sunday, May 02, 2010 7:48:40 AM
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DHCPv6 IAID . . . . . . . . . . . : 184556735
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-12-5A-4E-F3-00-1C-23-94-3E-23

DNS Servers . . . . . . . . . . . : 212.31.224.2
213.140.2.43
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Broadcom 440x 10/100 Integrated Controlle
r
Physical Address. . . . . . . . . : 00-1C-23-94-3E-23
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{E8C54BE4-B575-4528-86AF-F96022E82906}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection*:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{4A27DF42-2073-4BA9-B74E-46B870A0CBA1}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{D40912EB-767F-491D-8DA4-9DCD20A9C2A5}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{3F7A7090-05FC-4588-837B-F3C624635C09}:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #7
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Here is a copy of listadapters

C:Program Files (x86)WinpkFilterbini386>listadapters
The following network interfaces are available to MSTCP:
1) WAN Network Interface (IP).
Internal Name: DEVICENDISWANIP
Current MAC: 000000000000
Medium: 0x00000003
Current MTU: 1480
Current adapter mode = 0x0
Number of active WAN links: 0
2) WAN Network Interface (BH).
Internal Name: DEVICENDISWANBH
Current MAC: 000000000000
Medium: 0x00000003
Current MTU: 1500
Current adapter mode = 0x0
3) WAN Network Interface (IPv6).
Internal Name: DEVICENDISWANIPV6
Current MAC: 000000000000
Medium: 0x00000003
Current MTU: 1500
Current adapter mode = 0x0
Number of active WAN links: 0
4) Local Area Connection 2.
Internal Name: DEVICE{4A27DF42-2073-4BA9-B74E-46B870A0CBA1}
Current MAC: 00FF4A27DF42
Medium: 0x00000000
Current MTU: 1500
Current adapter mode = 0x0
5) Wireless Network Connection.
Internal Name: DEVICE{3F7A7090-05FC-4588-837B-F3C624635C09}
Current MAC: 001CBF238B3A
Medium: 0x00000000
Current MTU: 1500
Current adapter mode = 0x0
6) Local Area Connection.
Internal Name: DEVICE{E8C54BE4-B575-4528-86AF-F96022E82906}
Current MAC: 001C23943E23
Medium: 0x00000000
Current MTU: 1500
Current adapter mode = 0x0

Current system wide MTU decrement = 0

Default adapter startup mode = 0x0

[beggar]

Update:

I test signed all of the drivers for the winpkfilter. I am using 64bit windows 7. I checked my adapters and they show the winpkfilter driver in the properties. I checked my device manager and it shows the winpkfilter miniport for the adapters using the ndisrd_m.inf driver. Is the ndisrd.inf driver supposed to show up anywere ?

[Vadim Smirnov]

When dealing with NDIS IM drivers you should sign both CAT file and driver binaries (embedded signing).

Normally all WAN connections in Windows go through the NDISWANIP (for IPv4)/NDISWANIPV6 (for IPv6) Ethernet 802.3 emulation on top of WAN miniports. So if you need to filter packets going through WAN connection you are supposed to filter on NDISWANIP (or NDISWANIPV6) network adapter listed by listadapters.

Update:
ndisrd.inf describes protocol part of NDIS IM driver and installed with hidden attribute.

[beggar]

I went through a lot of posts in this forum over the weekend. So a few days ago I tested signed all of the drivers including the cat files. I had to do more research on how to create the cat files from the inf files. It was pretty simepl once I found out.

As far as the pppoe connection is concerned, I installed a router. Now my router gets to dial the connection and I connect my ethernet cable to the router. I am still having the same problem as before though. I am using software called nat32 that is based on the winkpkfilter. It is supposed to allow my pc to use mulitple internet connctions at the same time. It places itself on the windows route table with a lower metric and removes the other wireless and Lan adapter connections. It then allows me to choose which adapter connection to use to access the internet Even though the nat32 is allowing me to choose which connection to use for the internet, Windows doesn’t seem to allow me to switch between the two. I am only getting DNS requests from the same network adapter. The Others are there idle even though I may select them. So if figured I need to cover all bases started with the driver.

The Beggar

[Vadim Smirnov]

Well, we can’t be responsible for NAT32 behaviour because everything depends on how this application routes packets. If you can describe the problem with WinpkFilter itself I can try to help, but hardly likely I can help with NAT32. 🙄

[beggar]

My network adapters are locking up after around 15 minutes of use with the filter. I retain nslookup abilites, but no http or ping. I have to either diable/enable the adapters or do an ipconfig release and renew to get the adapters back online. Is there any way to monitor the filter to see if it is maintaining functionality

The Beggar

[Vadim Smirnov]

WinpkFilter has an internal packet pool for 500 packets, if the network gets locked then may be there are already 500 packets waiting for you to read them out from the driver. Try to call GetAdapterPacketQueueSize for every adapter you have set into tunnel/listen modes to see how many packets are queued and not processed by your application yet.

[beggar]

Is there a way I can monitor the packets without have to do too much programming. I spend the most part of the weekend failing at trying to come up with a way to monitor. I can’t seem to get a good exe file fom my VB program.

The Beggar

[Author]

Posts