Find UDP packet source address on multihomed host
in [Win32 Kernel]
|
Prev: Is there any way to move hiberfil.sys to another partition,..
Next: Fastest Possible Hardware Interrupt Response?
From: MB on 28 Jun 2008 22:55 My C++ Win32 program runs on a multihomed host and sends UDP packets using the sendto () Winsock API. The UDP socket is bound to INADDR_ANY (0.0.0.0) and is used to send packets to various destination addresses. Given a particular destination IP-address, I need to programmatically determine the network interface that will be used or, in other words, the source IP-address of the UDP packet. How can this be done? Also, is there perhaps a better newsgroup to ask this question in?
From: Kerem G�mr�kc� on 28 Jun 2008 23:10 Hi blabla, its much better to use any name than this, believe me! You could ask your question in one of the networking and driver development ngs. Try "Network Monitor" or try "Wireshark", they will help you. See this: http://en.wikipedia.org/wiki/WinPcap And this: http://tdifw.sourceforge.net/ See also here: http://osswin.sourceforge.net/#firewall Best way is to opeate with filters,... Regards Kerem -- -- ----------------------- Beste Gr�sse / Best regards / Votre bien devoue Kerem G�mr�kc� Microsoft Live Space: http://kerem-g.spaces.live.com/ Latest Open-Source Projects: http://entwicklung.junetz.de ----------------------- "This reply is provided as is, without warranty express or implied." "MB" <bla(a)bla.bla> schrieb im Newsbeitrag news:OqYIwOZ2IHA.5832(a)TK2MSFTNGP02.phx.gbl... > My C++ Win32 program runs on a multihomed host and sends UDP packets using > the sendto () Winsock API. The UDP socket is bound to INADDR_ANY (0.0.0.0) > and is used to send packets to various destination addresses. Given a > particular destination IP-address, I need to programmatically determine the > network interface that will be used or, in other words, the source > IP-address of the UDP packet. How can this be done? Also, is there perhaps a > better newsgroup to ask this question in? > >
From: Volodymyr M. Shcherbyna on 29 Jun 2008 05:16 Kerem, the link with tdi filter is wrong, because at tdi level you cannot get correct source ip data. 100 % correct data are obtained only at ndis layer. -- Volodymyr, blog: http://www.shcherbyna.com/ (This posting is provided "AS IS" with no warranties, and confers no rights) "Kerem G�mr�kc�" <kareem114(a)hotmail.com> wrote in message news:eGWL6aZ2IHA.4772(a)TK2MSFTNGP03.phx.gbl... > Hi blabla, > > its much better to use any name than this, believe me! > > You could ask your question in one of the networking > and driver development ngs. Try "Network > Monitor" or try "Wireshark", they will help you. > > See this: http://en.wikipedia.org/wiki/WinPcap > And this: http://tdifw.sourceforge.net/ > > See also here: > http://osswin.sourceforge.net/#firewall > > Best way is to opeate with filters,... > > Regards > > Kerem > > -- > -- > ----------------------- > Beste Gr�sse / Best regards / Votre bien devoue > Kerem G�mr�kc� > Microsoft Live Space: http://kerem-g.spaces.live.com/ > Latest Open-Source Projects: http://entwicklung.junetz.de > ----------------------- > "This reply is provided as is, without warranty express or implied." > > "MB" <bla(a)bla.bla> schrieb im Newsbeitrag > news:OqYIwOZ2IHA.5832(a)TK2MSFTNGP02.phx.gbl... >> My C++ Win32 program runs on a multihomed host and sends UDP packets >> using >> the sendto () Winsock API. The UDP socket is bound to INADDR_ANY >> (0.0.0.0) >> and is used to send packets to various destination addresses. Given a >> particular destination IP-address, I need to programmatically determine > the >> network interface that will be used or, in other words, the source >> IP-address of the UDP packet. How can this be done? Also, is there >> perhaps > a >> better newsgroup to ask this question in? >> >> > >
From: Kerem Gümrükcü on 29 Jun 2008 15:04 Hi V., i remebered the driver also capable of dissecting ip data and headers. If not, i must apologize here,.. I dont have the time to look through the complete code, but having a look at its capabilities and at some header files including this, it is very likely that he will get the source and destination of his udp data: ipc.h net.h Also have a look at the tdifw.conf file, where you can deny/allow UDP/TCP/ADRESSES/PROCESSES/USERS. I think it will help him.... Regards Kerem -- ----------------------- Beste Gr�sse / Best regards / Votre bien devoue Kerem G�mr�kc� Latest Project: http://www.codeplex.com/restarts Latest Open-Source Projects: http://entwicklung.junetz.de ----------------------- "This reply is provided as is, without warranty express or implied." "Volodymyr M. Shcherbyna" <v_scherbina(a)online.mvps.org> schrieb im Newsbeitrag news:OILNjjc2IHA.528(a)TK2MSFTNGP02.phx.gbl... > Kerem, the link with tdi filter is wrong, because at tdi level you cannot > get correct source ip data. 100 % correct data are obtained only at ndis > layer. > > -- > Volodymyr, blog: http://www.shcherbyna.com/ > (This posting is provided "AS IS" with no warranties, and confers no > rights) > "Kerem G�mr�kc�" <kareem114(a)hotmail.com> wrote in message > news:eGWL6aZ2IHA.4772(a)TK2MSFTNGP03.phx.gbl... >> Hi blabla, >> >> its much better to use any name than this, believe me! >> >> You could ask your question in one of the networking >> and driver development ngs. Try "Network >> Monitor" or try "Wireshark", they will help you. >> >> See this: http://en.wikipedia.org/wiki/WinPcap >> And this: http://tdifw.sourceforge.net/ >> >> See also here: >> http://osswin.sourceforge.net/#firewall >> >> Best way is to opeate with filters,... >> >> Regards >> >> Kerem >> >> -- >> -- >> ----------------------- >> Beste Gr�sse / Best regards / Votre bien devoue >> Kerem G�mr�kc� >> Microsoft Live Space: http://kerem-g.spaces.live.com/ >> Latest Open-Source Projects: http://entwicklung.junetz.de >> ----------------------- >> "This reply is provided as is, without warranty express or implied." >> >> "MB" <bla(a)bla.bla> schrieb im Newsbeitrag >> news:OqYIwOZ2IHA.5832(a)TK2MSFTNGP02.phx.gbl... >>> My C++ Win32 program runs on a multihomed host and sends UDP packets >>> using >>> the sendto () Winsock API. The UDP socket is bound to INADDR_ANY >>> (0.0.0.0) >>> and is used to send packets to various destination addresses. Given a >>> particular destination IP-address, I need to programmatically determine >> the >>> network interface that will be used or, in other words, the source >>> IP-address of the UDP packet. How can this be done? Also, is there >>> perhaps >> a >>> better newsgroup to ask this question in? >>> >>> >> >> > >
From: Volodymyr M. Shcherbyna on 30 Jun 2008 03:01
Well, at TDI level one is able to issue an IRP to obtain TDI_QUERY_ADDRESS_INFO to obtain source IP + Port information, but the problem is that in 80 % of cases the source IP is always zero. The only reliable solution is to get it at NDIS layer. -- Volodymyr, blog: http://www.shcherbyna.com/ (This posting is provided "AS IS" with no warranties, and confers no rights) "Kerem G�mr�kc�" <kareem114(a)hotmail.com> wrote in message news:%231sk3rh2IHA.3600(a)TK2MSFTNGP04.phx.gbl... > Hi V., > > i remebered the driver also capable of dissecting > ip data and headers. If not, i must apologize here,.. > > I dont have the time to look through the complete > code, but having a look at its capabilities and at > some header files including this, it is very likely that > he will get the source and destination of his udp > data: > > ipc.h > net.h > > Also have a look at the tdifw.conf file, where you can > deny/allow UDP/TCP/ADRESSES/PROCESSES/USERS. > > I think it will help him.... > > Regards > > Kerem > > -- > ----------------------- > Beste Gr�sse / Best regards / Votre bien devoue > Kerem G�mr�kc� > Latest Project: http://www.codeplex.com/restarts > Latest Open-Source Projects: http://entwicklung.junetz.de > ----------------------- > "This reply is provided as is, without warranty express or implied." > "Volodymyr M. Shcherbyna" <v_scherbina(a)online.mvps.org> schrieb im > Newsbeitrag news:OILNjjc2IHA.528(a)TK2MSFTNGP02.phx.gbl... >> Kerem, the link with tdi filter is wrong, because at tdi level you cannot >> get correct source ip data. 100 % correct data are obtained only at ndis >> layer. >> >> -- >> Volodymyr, blog: http://www.shcherbyna.com/ >> (This posting is provided "AS IS" with no warranties, and confers no >> rights) >> "Kerem G�mr�kc�" <kareem114(a)hotmail.com> wrote in message >> news:eGWL6aZ2IHA.4772(a)TK2MSFTNGP03.phx.gbl... >>> Hi blabla, >>> >>> its much better to use any name than this, believe me! >>> >>> You could ask your question in one of the networking >>> and driver development ngs. Try "Network >>> Monitor" or try "Wireshark", they will help you. >>> >>> See this: http://en.wikipedia.org/wiki/WinPcap >>> And this: http://tdifw.sourceforge.net/ >>> >>> See also here: >>> http://osswin.sourceforge.net/#firewall >>> >>> Best way is to opeate with filters,... >>> >>> Regards >>> >>> Kerem >>> >>> -- >>> -- >>> ----------------------- >>> Beste Gr�sse / Best regards / Votre bien devoue >>> Kerem G�mr�kc� >>> Microsoft Live Space: http://kerem-g.spaces.live.com/ >>> Latest Open-Source Projects: http://entwicklung.junetz.de >>> ----------------------- >>> "This reply is provided as is, without warranty express or implied." >>> >>> "MB" <bla(a)bla.bla> schrieb im Newsbeitrag >>> news:OqYIwOZ2IHA.5832(a)TK2MSFTNGP02.phx.gbl... >>>> My C++ Win32 program runs on a multihomed host and sends UDP packets >>>> using >>>> the sendto () Winsock API. The UDP socket is bound to INADDR_ANY >>>> (0.0.0.0) >>>> and is used to send packets to various destination addresses. Given a >>>> particular destination IP-address, I need to programmatically determine >>> the >>>> network interface that will be used or, in other words, the source >>>> IP-address of the UDP packet. How can this be done? Also, is there >>>> perhaps >>> a >>>> better newsgroup to ask this question in? >>>> >>>> >>> >>> >> >> > |