Vadim Smirnov

Forum Replies Created

Viewing 15 posts - 961 through 975 (of 1,474 total)
  • Author
    Posts
  • in reply to: detect Sent or received message? #6544
    Vadim Smirnov
    Keymaster

      please do not say me though the winpkfilter data. How can i handle that though the gernal ip-header or tcp-header?

      You can try to match Ethernet/IP address information (an example, source MAC == local NIC MAC ==> outgoing), but this does not give any guarantee because it is possible to send an arbitrary packet on the network.

      in reply to: Packet Length via ip_len failed? #6543
      Vadim Smirnov
      Keymaster

        pIpHeader->ip_len is in network byte order, so it should be:

        DWORD dwDataLength = ntohs(pIpHeader->ip_len) - ( pIpHeader->ip_hl*4 + pTcpHeader->th_off*4);
        in reply to: Create New Ethernet Packet problem #6374
        Vadim Smirnov
        Keymaster

          Can winpkfilter be used to send packet as if it is coming from remote PC ( internet remote host like yahoo ? )

          Sure. The easiest way for you to start is take and parse the normally received packet (intercepted from the network). You can do it with one of the network sniffers (like Network Monitor or Ethereal). Then just build your own packet with WinpkFilter on the same way. Of course it requires some understanding of how TCP/IP works..

          in reply to: VirtNet doesn’t appear in taskmgr #6547
          Vadim Smirnov
          Keymaster

            Drivers are not displayed in Task Manager which shows only user mode processes. You can see services associated with the virtual NIC’s (like in case with VMware), but not the drivers themselves.

            in reply to: Packet Manipulation #6541
            Vadim Smirnov
            Keymaster

              Sending modified packet does not differ from sending unmodified one, however take care to recalculate packet checksums.

              in reply to: NDIS IM – change packet content #6533
              Vadim Smirnov
              Keymaster

                Судя пр крашу пакет переданный в NdisMSendComplete уже не валиден. Какой статус был возвращен из MiniportSend? Используется ли MiniportSendPackets?

                in reply to: NDIS IM – change packet content #6531
                Vadim Smirnov
                Keymaster

                  Вряд ли кто-то сможет что-либо по этому отписать, поскольку неясно даже где и с каким кодом падает. Хотя бы выход с !analyze-v запостил…

                  in reply to: NDIS_MINIPORT_BLOCK #6537
                  Vadim Smirnov
                  Keymaster

                    При каких исходных данных?

                    in reply to: Can TCPSendData(…) see the SMB packets? #6507
                    Vadim Smirnov
                    Keymaster

                      Тема с TCPSendData раскрыта тут http://www.ntkernel.com/w&p.php?id=17

                      Эту функцию нужно перехватывать дополнительно.

                      in reply to: adlist interface order changes in Vista #6529
                      Vadim Smirnov
                      Keymaster

                        In common the order of network adapters reported by WinpkFilter is not permanent. Network adapters are added into the list in the order of their initialization by the system, in most cases it is always the same for the particular system, but it is not guaranteed to be.

                        It is better to identify network interfaces by their internal names instead of the index in the network adapters list.

                        in reply to: Windows 2003 Crashing with NeT firewall… #6527
                        Vadim Smirnov
                        Keymaster

                          UPDATE 1: It appears the problem is related to the Firewall with Hamachi. Is there a way to totally exclude filtering on a specific interface? I configured all to rules to be binded to the real interface and the Hamachi virtual nic is set to “Low Level Security” but I think we should have another option for “Disable Filtering on this Interface” (or kind of). Thanks!

                          The conflict between low level network software is quite possible. By default NeT Firewall intercepts all network adapters bound to TCP/IP and this can’t be change through the management console. It would require rebuilding NeT Firewall driver with a special check on Hamachi network interface.

                          I will check what really happens with Hamachi once I have some spare time.

                          in reply to: WinpkFilter news/updates. #5508
                          Vadim Smirnov
                          Keymaster

                            WinpkFilter 3.0.4 released. This service release includes:

                            1) Compatibility fixes in WinpkFilter API DLL and drivers
                            2) x64 driver support for 32 bit code running in WOW64. This feature should be useful for developers whose development tools does not include x64 native compiler. An example, Delphi 32-bit application can work with WinpkFilter driver on Windows x64.
                            3) Kernel level filters. You can load a filter table into WinpkFilter driver which defines rules for packet pass, block or redirect_and_ process by your application. This may seriously improve perfomance.
                            4) C# interface and samples

                            Important note:
                            For Windows Vista and later versions of the Windows family of operating systems, kernel-mode software must have a digital signature to load on x64-based computer systems. WinpkFilter drivers are not signed and in order to test them on Vista x64 you should press F8 during system boot and choose Disable Driver Signature Enforcement option. For the commercial software you’d have to obtain Code Signing certificate from Verysign or another Certificate Authority authorized by Microsoft.

                            If you are eligible for a free update, please send the following details to support@ntkernel.com to receive an update instruction:

                            1. Your order ID.
                            2. An approximate date of purchasing.

                            in reply to: Create New Ethernet Packet problem #6372
                            Vadim Smirnov
                            Keymaster

                              If I use this code and trace it using packet sniffer it sends the packets. I am sending the packet to local PC itself. But in the sniffed packet I see Frame check sequence error. Will it create any problem. Can u please tell me why the error occurring ? And what I am missing here ?

                              The code above initializes only Ethernet header and sets next protocol as IP without initializing the IP header. This may cause sniffers to show this packet as a bogus one.

                              in reply to: winpkfilter & WIFI #6526
                              Vadim Smirnov
                              Keymaster

                                Packets [received from]/[sent to] WiFi network interface are normal Ethernet 802.3 frames (WiFi NIC driver strips 802.11 specific headers). So basically at the NDIS level WiFi network interface does not differ from normal LAN interface and packets can be processed at the same way.

                                in reply to: winpkfilter & WIFI #6524
                                Vadim Smirnov
                                Keymaster

                                  1- can winpkfilter supporte WIFI paquets ?.

                                  Yes

                                  2- Is the paquets captured by winpkfilter ara the original paquets or
                                  just a copy of original? .

                                  Not sure what you really mean here, but if you modify the packet which is sent/received over WiFi it will come modified to network/MSTCP. This is unlike winpcap which gives you a copy of the packet and its modification won’t change anything.

                                Viewing 15 posts - 961 through 975 (of 1,474 total)