[bakhtiar]

Hi;

As the in_addr struct is not availabile in iphlp.cs, this is for those who wants to use this struct in c#.

[StructLayout(LayoutKind.Auto)]

public struct sb
{
public byte s_b1, s_b2, s_b3, s_b4;
}

[StructLayout(LayoutKind.Auto)]

public struct sw
{
public ushort s_w1, s_w2;
}

[StructLayout(LayoutKind.Explicit, Size = 4)]
public struct in_addr
{
[FieldOffset(0)]
public sb S_un_b;
[FieldOffset(0)]
public sw S_un_w;
[FieldOffset(0)]
public uint S_addr;
}

[bakhtiar]

Hello;

This means that packets can be dropped or passed either using static filters or checking against a condition in IM buffer, but for the last approach it has more overhead and less performance, am I right?

Regards

[bakhtiar]

Hi;

In Tunnelling mode, Is it possible to read a packet to IM buffer and if this packet matches a condition then it do not resend it back to adapter or MSTCP (by this way the packet has been dropped).. Is it an efficient way to allow or drop packets.

Regards

[bakhtiar]

Hi;

For example, there is a filter to drop all HTTP packet, how can I now when the packet came and been captured, I want to alert the user that those packets been captured.

Regards

[bakhtiar]

How? because when a packet been captured by a filter it can not be read the IM buffer. Is it right?

Regards

[bakhtiar]

Thanks, this indicates a packet in general but I want to know when a specific packet caught by one of the filters.

Kind regards

[bakhtiar]

Thanks SerpentFly;

Is filtering occurs in NDIS level (driver) for incoming and outgoing packets or in intermediate buffer? Or it might be happen in both?
If a packet is dropped, this packet can not be brought to intermediate buffer, is this right?

Kind regards

[bakhtiar]

Hi;

I have added the line, but now I got the following errors:

1>c:university datafirewallwinpkfilterwinpkfilteradapter.cpp(2) : warning C4129: ‘P’ : unrecognized character escape sequence
1>c:university datafirewallwinpkfilterwinpkfilteradapter.cpp(2) : warning C4129: ‘W’ : unrecognized character escape sequence
1>c:university datafirewallwinpkfilterwinpkfilteradapter.cpp(2) : warning C4129: ‘k’ : unrecognized character escape sequence
1>c:university datafirewallwinpkfilterwinpkfilteradapter.cpp(2) : warning C4129: ‘d’ : unrecognized character escape sequence
1>c:university datafirewallwinpkfilterwinpkfilteradapter.cpp(2) : warning C4129: ‘i’ : unrecognized character escape sequence
1>Linking…
1>LINK : fatal error LNK1104: cannot open file ‘c:Program FilesWinpkFilterkernelindlli386
1>disapi.lib’

Regards

@master.asc wrote:

by example try this:

// this is your real code:

#include “stdafx.h”

// include this..
#pragma comment(lib,’path to your nsdisapi.lib including ndisapi.lib’)

int main(int argc, char* argv[])
{
CNdisApi api;
TCP_AdapterList AdList;
OSVERSIONINFO verInfo;

…
}

OR, maybe you change the calling convention on your compiler, first try this

[bakhtiar]

@SerpentFly wrote:

snetcfg is shipped in source code to all WinpkFilter licensees.

Is it required to run the samples in the WinpkFilter? FYI I’m using Visual Studio 2008 installed on Vista.

[Author]

Posts