[Vadim Smirnov]

The driver is production signed, so you should not have digital signature problems with installing it. Do you use the driver build from amd64 folder?

[Vadim Smirnov]

What is the version of Windows you use?

[Vadim Smirnov]

Driver version returned by CNdisApi::GetVersion() is: 34025472

In hex this is 0x02073000 or version 3.2.7.

And if NDISAPI returns this value then it definitely means that driver is loaded!

[Vadim Smirnov]

Source code for latest version of ndisapi with a couple of new samples is now available on Github. I’ve just tested dnstracer with and and without WinpkFilter driver installed and availability of the driver was reported properly (so the calls to CNdisApi::IsDriverLoaded worked correct).

What was the Windows version you have tested? I’m not sure, but if you use NCF_HIDDEN attribute for your driver build then it may also affect netcfg output.

[Vadim Smirnov]

block the list of ip addresses which is ddosing us

WinpkFilter built-in filters allow IP address based blocking.

[Vadim Smirnov]

You could use WinpkFilter library to redirect UDP packets for processing in user mode and pass everything else. In your application you can implement any sort of analyses for redirected UDP (including sub string search and etc. ) packets and decide to block/pass or even modify them.

[Vadim Smirnov]

Sure, it is possible using built-in WinpkFilter filter engine if the criteria for the packets is not too complex (UDP packets with particular IP/port information). If you need something more complex you can redirect UDP packets for the processing in the application and block the rest in the kernel.

[Vadim Smirnov]

If two different application operate on different network adapters then yes, they can share single filter driver. Otherwise, no because there is only one copy of the packet in the driver.

So you have two choices, build your filtering engine as a dedicated service process and use from two different applications, or build two different filter drivers, one per application. First approach probably better from the performance point of view.

[Vadim Smirnov]

WinpkFilter 3.2.16.1 update:

• Fixed SetAdaptersStartupMode behavior
• Fixed NdisrdRequest behaviour in WOW64 mode

If you are eligible for a free update, please send the following details to [email protected] tо receive an update instruction:

Your order ID.
An approximate date of purchasing.

[Vadim Smirnov]

Попробуйте свежую сборку 3.2.14. Возможно проблема с пропускной способностью имеет отношение к Receive Segment Coalescing (RSC).

[Vadim Smirnov]

WinpkFilter 3.2.14.1 update:

• Receive Segment Coalescing (RSC) task offload issue fixed (could cause packet loss and performance degradation for some network interfaces)
• Added hardware filter change notification event API SetHwPacketFilterEvent

If you are eligible for a free update, please send the following details to [email protected] tо receive an update instruction:

Your order ID.
An approximate date of purchasing.

[Vadim Smirnov]

Windows Packet Filter 3.2.9.1 update:

• Added extended validation for the parameters passed from client application to WinpkFilter drivers. Some additional related information is available here

If you are eligible for a free update, please send the following details to [email protected] tо receive an update instruction:

Your order ID.
An approximate date of purchasing.

[Vadim Smirnov]

У меня под рукой была чистая Windows 10 x64 с тестовой сборкой драйвера 3.2.10.2 (доступна по ссылке выше). Готовый бинарник ebridge.exe взял с github. Так как это laptop, то гигабитный порт всего один, в качестве второго сетевого интерфейса использовался USB Ethernet адаптер ‘ASIX AX88772B USB2.0 to Fast Ethernet’. Соответственно пропускная способность моста ограничена 100 Mbps, в остальном все аналогично:

LAN <-1Gbps-> [192.168.1.238 | EBRIDGE | 192.168.1.247] <-100Mbps-> [192.168.1.220]

Сервер на 192.168.1.220, клиент поочередно с 192.168.1.238 и 192.168.1.247 в прямом и обратном порядке:

PS C:\Users\vadim\Desktop\iperf3> ./iperf3.exe -c 192.168.1.220
Connecting to host 192.168.1.220, port 5201
[ 4] local 192.168.1.238 port 50273 connected to 192.168.1.220 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.00 sec 11.5 MBytes 96.4 Mbits/sec
[ 4] 1.00-2.01 sec 11.4 MBytes 94.9 Mbits/sec
[ 4] 2.01-3.00 sec 11.2 MBytes 94.9 Mbits/sec
[ 4] 3.00-4.01 sec 11.4 MBytes 94.8 Mbits/sec
[ 4] 4.01-5.00 sec 11.2 MBytes 95.0 Mbits/sec
[ 4] 5.00-6.01 sec 11.4 MBytes 94.8 Mbits/sec
[ 4] 6.01-7.01 sec 11.4 MBytes 95.0 Mbits/sec
[ 4] 7.01-8.00 sec 11.2 MBytes 95.0 Mbits/sec
[ 4] 8.00-9.00 sec 11.2 MBytes 94.8 Mbits/sec
[ 4] 9.00-10.01 sec 11.4 MBytes 94.9 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.01 sec 113 MBytes 95.1 Mbits/sec sender
[ 4] 0.00-10.01 sec 113 MBytes 95.0 Mbits/sec receiver

iperf Done.
PS C:\Users\vadim\Desktop\iperf3> ./iperf3.exe -c 192.168.1.220 -R
Connecting to host 192.168.1.220, port 5201
Reverse mode, remote host 192.168.1.220 is sending
[ 4] local 192.168.1.238 port 50276 connected to 192.168.1.220 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.00 sec 11.7 MBytes 97.9 Mbits/sec
[ 4] 1.00-2.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 2.00-3.00 sec 11.3 MBytes 94.6 Mbits/sec
[ 4] 3.00-4.00 sec 11.3 MBytes 94.8 Mbits/sec
[ 4] 4.00-5.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 5.00-6.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 6.00-7.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 7.00-8.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 8.00-9.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 9.00-10.00 sec 11.3 MBytes 94.7 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 114 MBytes 95.2 Mbits/sec sender
[ 4] 0.00-10.00 sec 114 MBytes 95.2 Mbits/sec receiver

iperf Done.
PS C:\Users\vadim\Desktop\iperf3> ./iperf3.exe -c 192.168.1.220 -B 192.168.1.247
Connecting to host 192.168.1.220, port 5201
[ 4] local 192.168.1.247 port 50281 connected to 192.168.1.220 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.01 sec 11.6 MBytes 96.6 Mbits/sec
[ 4] 1.01-2.00 sec 11.2 MBytes 95.0 Mbits/sec
[ 4] 2.00-3.01 sec 11.4 MBytes 94.7 Mbits/sec
[ 4] 3.01-4.00 sec 11.2 MBytes 95.1 Mbits/sec
[ 4] 4.00-5.01 sec 11.4 MBytes 94.8 Mbits/sec
[ 4] 5.01-6.00 sec 11.2 MBytes 95.0 Mbits/sec
[ 4] 6.00-7.01 sec 11.4 MBytes 94.8 Mbits/sec
[ 4] 7.01-8.00 sec 11.2 MBytes 94.9 Mbits/sec
[ 4] 8.00-9.01 sec 11.4 MBytes 95.0 Mbits/sec
[ 4] 9.01-10.00 sec 11.2 MBytes 95.0 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 113 MBytes 95.1 Mbits/sec sender
[ 4] 0.00-10.00 sec 113 MBytes 95.0 Mbits/sec receiver

iperf Done.
PS C:\Users\vadim\Desktop\iperf3> ./iperf3.exe -c 192.168.1.220 -B 192.168.1.247 -R
Connecting to host 192.168.1.220, port 5201
Reverse mode, remote host 192.168.1.220 is sending
[ 4] local 192.168.1.247 port 50283 connected to 192.168.1.220 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.00 sec 11.7 MBytes 98.0 Mbits/sec
[ 4] 1.00-2.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 2.00-3.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 3.00-4.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 4.00-5.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 5.00-6.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 6.00-7.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 7.00-8.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 8.00-9.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 9.00-10.00 sec 11.3 MBytes 94.6 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 114 MBytes 95.2 Mbits/sec sender
[ 4] 0.00-10.00 sec 114 MBytes 95.2 Mbits/sec receiver

iperf Done.

Сервер на 192.168.1.238 и 192.168.1.247, клиент поочередно на каждый из адресов сервера в прямом и обратном порядке:

PS D:\iperf3> ./iperf3.exe -c 192.168.1.238
Connecting to host 192.168.1.238, port 5201
[ 4] local 192.168.1.220 port 2182 connected to 192.168.1.238 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.00 sec 11.5 MBytes 96.3 Mbits/sec
[ 4] 1.00-2.01 sec 11.4 MBytes 94.7 Mbits/sec
[ 4] 2.01-3.01 sec 11.2 MBytes 94.7 Mbits/sec
[ 4] 3.01-4.00 sec 11.2 MBytes 94.7 Mbits/sec
[ 4] 4.00-5.01 sec 11.4 MBytes 94.7 Mbits/sec
[ 4] 5.01-6.00 sec 11.1 MBytes 94.0 Mbits/sec
[ 4] 6.00-7.00 sec 11.4 MBytes 95.4 Mbits/sec
[ 4] 7.00-8.01 sec 11.4 MBytes 94.7 Mbits/sec
[ 4] 8.01-9.00 sec 11.1 MBytes 93.9 Mbits/sec
[ 4] 9.00-10.00 sec 11.2 MBytes 94.5 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 113 MBytes 94.8 Mbits/sec sender
[ 4] 0.00-10.00 sec 113 MBytes 94.7 Mbits/sec receiver

iperf Done.
PS D:\iperf3> ./iperf3.exe -c 192.168.1.247
Connecting to host 192.168.1.247, port 5201
[ 4] local 192.168.1.220 port 2185 connected to 192.168.1.247 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.00 sec 11.5 MBytes 96.4 Mbits/sec
[ 4] 1.00-2.01 sec 11.4 MBytes 94.6 Mbits/sec
[ 4] 2.01-3.00 sec 11.1 MBytes 94.1 Mbits/sec
[ 4] 3.00-4.00 sec 11.2 MBytes 94.3 Mbits/sec
[ 4] 4.00-5.01 sec 11.5 MBytes 95.7 Mbits/sec
[ 4] 5.01-6.01 sec 11.2 MBytes 94.7 Mbits/sec
[ 4] 6.01-7.00 sec 11.2 MBytes 94.7 Mbits/sec
[ 4] 7.00-8.01 sec 11.4 MBytes 94.7 Mbits/sec
[ 4] 8.01-9.01 sec 11.1 MBytes 93.8 Mbits/sec
[ 4] 9.01-10.00 sec 11.4 MBytes 95.6 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 113 MBytes 94.9 Mbits/sec sender
[ 4] 0.00-10.00 sec 113 MBytes 94.7 Mbits/sec receiver

iperf Done.
PS D:\iperf3> ./iperf3.exe -c 192.168.1.238 -R
Connecting to host 192.168.1.238, port 5201
Reverse mode, remote host 192.168.1.238 is sending
[ 4] local 192.168.1.220 port 2187 connected to 192.168.1.238 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.00 sec 11.7 MBytes 98.0 Mbits/sec
[ 4] 1.00-2.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 2.00-3.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 3.00-4.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 4.00-5.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 5.00-6.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 6.00-7.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 7.00-8.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 8.00-9.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 9.00-10.00 sec 11.3 MBytes 94.9 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 114 MBytes 95.3 Mbits/sec sender
[ 4] 0.00-10.00 sec 114 MBytes 95.3 Mbits/sec receiver

iperf Done.
PS D:\iperf3> ./iperf3.exe -c 192.168.1.247 -R
Connecting to host 192.168.1.247, port 5201
Reverse mode, remote host 192.168.1.247 is sending
[ 4] local 192.168.1.220 port 2189 connected to 192.168.1.247 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.00 sec 11.7 MBytes 98.1 Mbits/sec
[ 4] 1.00-2.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 2.00-3.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 3.00-4.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 4.00-5.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 5.00-6.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 6.00-7.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 7.00-8.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 8.00-9.00 sec 11.3 MBytes 94.9 Mbits/sec
[ 4] 9.00-10.00 sec 11.3 MBytes 94.9 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 114 MBytes 95.4 Mbits/sec sender
[ 4] 0.00-10.00 sec 114 MBytes 95.4 Mbits/sec receiver

iperf Done.

И еще одна конфигурация, iperf сервер на 192.168.1.220, мост только перекладывает пакеты:

[192.168.1.25] <-1Gbps-> [192.168.1.238 | EBRIDGE | 192.168.1.247] <-100Mbps-> [192.168.1.220]

PS D:\tools\iperf3> ./iperf3 -c 192.168.1.220
Connecting to host 192.168.1.220, port 5201
[ 4] local 192.168.1.25 port 18031 connected to 192.168.1.220 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.01 sec 11.6 MBytes 96.4 Mbits/sec
[ 4] 1.01-2.00 sec 11.2 MBytes 95.1 Mbits/sec
[ 4] 2.00-3.00 sec 11.2 MBytes 94.8 Mbits/sec
[ 4] 3.00-4.01 sec 11.4 MBytes 94.9 Mbits/sec
[ 4] 4.01-5.00 sec 11.2 MBytes 94.9 Mbits/sec
[ 4] 5.00-6.01 sec 11.4 MBytes 94.9 Mbits/sec
[ 4] 6.01-7.01 sec 11.4 MBytes 94.9 Mbits/sec
[ 4] 7.01-8.00 sec 11.2 MBytes 95.0 Mbits/sec
[ 4] 8.00-9.00 sec 11.2 MBytes 94.8 Mbits/sec
[ 4] 9.00-10.00 sec 11.2 MBytes 94.4 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 113 MBytes 95.0 Mbits/sec sender
[ 4] 0.00-10.00 sec 113 MBytes 95.0 Mbits/sec receiver

iperf Done.
PS D:\tools\iperf3> ./iperf3 -c 192.168.1.220 -R
Connecting to host 192.168.1.220, port 5201
Reverse mode, remote host 192.168.1.220 is sending
[ 4] local 192.168.1.25 port 18042 connected to 192.168.1.220 port 5201
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-1.00 sec 11.7 MBytes 98.0 Mbits/sec
[ 4] 1.00-2.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 2.00-3.00 sec 11.3 MBytes 94.8 Mbits/sec
[ 4] 3.00-4.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 4.00-5.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 5.00-6.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 6.00-7.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 7.00-8.00 sec 11.3 MBytes 94.6 Mbits/sec
[ 4] 8.00-9.00 sec 11.3 MBytes 94.7 Mbits/sec
[ 4] 9.00-10.00 sec 11.3 MBytes 94.7 Mbits/sec
– – – – – – – – – – – – – – – – – – – – – – – – –
[ ID] Interval Transfer Bandwidth
[ 4] 0.00-10.00 sec 114 MBytes 95.2 Mbits/sec sender
[ 4] 0.00-10.00 sec 114 MBytes 95.2 Mbits/sec receiver

iperf Done.

Во всех случая производительность одинаковая и упирается в пропускную способность Fast Ethernet адаптера.

Похоже на то что проблема специфична для вашего стенда, сложно сказать в железе ли дело или в установленном софте, стоит попробовать собрать еще один и все перепроверить.

[Vadim Smirnov]

В дампах я проблем не вижу, TCP сессия идет вполне успешно, значит дело скорей всего в самом приложении моста. Ethernet Bridge был написан для демонстрации, я не тестировал его производительность, но 2.5 Mbps выглядит слабовато. Поскольку на производительность может влиять множество факторов, несколько вопросов:

1. Это полностью оригинальный Ethernet Bridge или в него добавлен какой-то еще код? Даже одна строка может иметь значение…
2. На 64-битной системе используется 64-битная сборка Ethernet Bridge? Использование 32-битной сборки на 64 битной системе не лучшим образом сказывается на производительности.
3. Используется Release build?
4. Хотелось бы увидеть загрузку ядер CPU и загрузку сети по обоим хостам.

[Vadim Smirnov]

Возможно возникает эффект циклического рероутинга, когда один и тот же пакет рероутится на одном и том же интерфейсе пока не истечет TTL. Это несложно проверить посмотрев снифером трафик на проседающем интерфейсе. Обычно для того чтобы избавиться от этого эффекта достаточно отключить IP forwarding. Стандартный инсталлятор для WinpkFilter включает IP forwarding в реестре если при установке выбран Internet Gateway. Попробуйте отключить (если включен), перезагрузиться и протестировать еще раз. Если не поможет то хотелось бы взглянуть на то что покажет сетевой сниффер.

IPEnableRouter

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
Data type Range Default value
REG_DWORD 0 | 1 0
Description

Determines whether the system routes IP packets to the networks to which it is connected.
Value Meaning
0 The system routes IP packets.
1 IP packets are not routed.

[Author]

Posts