Prev: Kernel mode DLL problem
Next: What are the driver signing options in Vista 32bit
From: Alireza Dabagh [MS] on 13 May 2008 20:00
So from your reply I take it you are interested in getting packets destined
to other hosts -that are not necessarily originated from the host your
filter is running on-.

As I said in my previous post, setting the adapter to promiscuous mode is
not going to help you. Switch is not going to put them on the port your NIC
is connected to.

-ali

--
This posting is provided "AS IS" with no warranties, and confers no rights.

<vasantharaj.g(a)nestgroup.net> wrote in message
news:83b3e81c-8cd8-4ba4-a5b3-04a8a5dc938a(a)f24g2000prh.googlegroups.com...
Hi !

Yes, the filter hook driver I mentioned is as per the msdn
documentation mentioned. Basically it is an extension to the OS
supplied packet filter. The filter hook driver works fine and I am
able to get packets to an fro the host machine. As part of the
requirement, I need to get the packets destined to another machine in
the same sub net.

It could be possible if I could enable the respective adapter and the
NIC to promiscuous mode. How can I set the
OID_GEN_CURRENT_PACKET_FILTER with type NDIS_PACKET_TYPE_PROMISCUOUS
from the filterhook driver? Is this possible? If so how? Should I
write another mini port interface?

thanks in advance,

regards,
vasanth.



On May 13, 7:42 am, PCAUSA <pca...(a)gmail.com> wrote:
> He is probably referring to this tyoe of Filter Hook, documented in
> MSDN at URL:
>
> http://msdn.microsoft.com/en-us/library/ms802735.aspx
>
> Thomas F. Divine
>
> On May 12, 5:59 pm, "Alireza Dabagh [MS]" <a...(a)online.microsoft.com>
> wrote:
>
>
>
> > I did not understand exactly what your component is. "Filter hook
> > driver"
> > could mean one of those nasty virus like drivers that take a shortcut by
> > hijacking NDIS and TCPIP entry points. It could also mean an NDIS IM
> > filter
> > (or lightweight filter for NDIS 6 and higher) drivers written to spec or
> > it
> > could be something else. If your driver is hijacking NDIS/TCPIP entry
> > points, please disregard my mail. Unfortunately many people on this
> > newsgroup will help you nevertheless. I can't.
>
> > If your object is to see packets sent to the other interfaces on the
> > network -from- this machine, then just look at them on the transmit
> > path.
>
> > If you want to see packets sent to the other interfaces connected to the
> > same switch then read on.
>
> > You set a NIC to promiscuous mode by sending a set_packet_filter OID to
> > the
> > NIC. (you need to be a NDIS protocol or lightweight driver to do this ).
> > But
> > that will not help you. Any switch worth the box it came in, will not
> > allow
> > you to see "packets destined to other machines in the network" just
> > because
> > you set the NIC to promiscuous mode (with the exception of being
> > connected
> > to a "mirror" port).
>
> > -ali
>
> > --
> > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
>
> > <vasanthara...(a)nestgroup.net> wrote in message
>
> >news:e37c994c-0a95-45bb-9e25-b0f59256a490(a)f24g2000prh.googlegroups.com...>
> >Hi !
>
> > > I want to receive all packets in my filter hook driver and do
> > > filtering the TCP packets which matches a particular destination
> > > address in the network. So, I wrote a filter hook driver and is
> > > working fine. Now, I want to get packets destined to other machines
> > > also in the network, from my filter hook driver. How can I set the NIC
> > > to promiscuous mode so that I shall receive other packets also in my
> > > PacketFilterExtension function.
>
> > > Is it possible? If so, how can I set it?
>
> > > Please help.
>
> > > thanks in advance,
>
> > > regards,
> > > vasanth.- Hide quoted text -
>
> - Show quoted text -

First  |  Prev  | 
Pages: 1 2
Prev: Kernel mode DLL problem
Next: What are the driver signing options in Vista 32bit