How to control loopback packets.

[boooooom]

Hi.

I want to control loopback packets using WinpkFilter.

So, I added a flag MSTCP_FLAG_LOOPBACK_FILTER for SetAdaptersStartupMode().

But I can’t capture loopback packets.

Is there something different than other packets to do for loopback?

[Vadim Smirnov]

If you mean localhost packets (an example, two applications communicating via Winsock and running on the same system) then these packets are processed internally by TCP/IP and never reach NDIS layer. So you can’t use WinpkFilter to control these packets. However, you can use Local Network Monitor, which is based on TDI filter driver and allows to intercept localhost data transfers.

[boooooom]

Thanks to your reply.

I use Winpkfilter in local network.

I have some questions about how to capture loopback packets.

In struct _STATIC_FILTER, I use FILTER_PACKET_REDIRECT flag for m_FilterAction. Is it right?

What is data in m_NetworkFilter.m_IPv4.m_ValidFields when I capture loopback packets?

PACKET_FLAG_ON_SEND or PACKET_FLAG_ON_RECEIVE?

Thank you again.

[Vadim Smirnov]

Are you sure that you need these kind of loopback packets? In WinpkFilter context loopback packets are the packets indicated by NDIS layer to bound protocols in response of outgoing packet from one of the bound protocols. An example, TCP/IP sends a packet without NDIS_FLAGS_DONT_LOOPBACK. In this case packets does not only go out on the network media, but normally it is also indicated back to protocol layer as it would be received from the network. Some additional information on loopback packets you can find here http://www.ndis.com/ndis-ndis5/loopback/loopback.htm

[Author]

Posts