locked
IpDiscardMalformedHeader RRS feed

  • Question

  • Hi All,

    I am encountering a strange problem. I did transparent proxying by modifying desctination port and ip in outbound transport layer and remodifying it in inbound ip layer. I have also calculated the seq number. The above setup works perfectly for a wired network. But for a wireless network namely wifi, tcp is unable to establish a handshake.

    On analysing this i found that packets are dropped at ip discard layer with the reason "IpDiscardMalformedHeader". Can anyone please tell me what exactly is the difference in wired and wireless communication with respect to tcp/ip and what exactly "IpDiscardMalformedHeader" indicates.

    I really appreaciate any help.

    Aravind

    Tuesday, January 19, 2010 9:01 AM

Answers

  • Did you re-calculate the IP checksum after modification? Perhaps one NIC performs checksum verification in hardware while the other doesn't?

    Biao.W.

    Thursday, January 21, 2010 5:17 AM
  • From http://msdn.microsoft.com/en-us/library/aa938504.aspx

    Callouts must adjust the IP or transport layer checksum, or both, after they modify an IP packet.
    A callout can set the checksum to 0 for UDP over IPv4 packets.
    To be compatible with transport layer checksum offload, and to adjust the full checksum versus pseudo
    checksum calculations accordingly, a callout can use the following logic:
    NDIS_TCP_IP_CHECKSUM_PACKET_INFO ChecksumInfo; ChecksumInfo.Value = (ULONG)(ULONG_PTR)NET_BUFFER_LIST_INFO(NetBufferList,
    TcpIpChecksumNetBufferListInfo); If ChecksumInfo.Transmit.NdisPacketTcpChecksum is TRUE, the TCP send operation will be offloaded.
    If ChecksumInfo.Transmit.NdisPacketUdpChecksum is TRUE, the UDP send operation will be offloaded.

    Hope this helps

    Dusty Harper [MSFT]
    Microsoft Corporation
    ------------------------------------------------------------
    This posting is provided "AS IS", with NO warranties and confers NO rights
    ------------------------------------------------------------
    Thursday, February 4, 2010 11:04 PM
    Moderator

All replies

  • Did you re-calculate the IP checksum after modification? Perhaps one NIC performs checksum verification in hardware while the other doesn't?

    Biao.W.

    Thursday, January 21, 2010 5:17 AM
  • Biao.W.

    I recalculated checksum and everything worked fine. I have one more doubt how can i determine if the NIC can calculate checksum or not. Please help as i dont want to slow down the system even a bit.

    Aravind
    Wednesday, February 3, 2010 1:36 PM
  • From http://msdn.microsoft.com/en-us/library/aa938504.aspx

    Callouts must adjust the IP or transport layer checksum, or both, after they modify an IP packet.
    A callout can set the checksum to 0 for UDP over IPv4 packets.
    To be compatible with transport layer checksum offload, and to adjust the full checksum versus pseudo
    checksum calculations accordingly, a callout can use the following logic:
    NDIS_TCP_IP_CHECKSUM_PACKET_INFO ChecksumInfo; ChecksumInfo.Value = (ULONG)(ULONG_PTR)NET_BUFFER_LIST_INFO(NetBufferList,
    TcpIpChecksumNetBufferListInfo); If ChecksumInfo.Transmit.NdisPacketTcpChecksum is TRUE, the TCP send operation will be offloaded.
    If ChecksumInfo.Transmit.NdisPacketUdpChecksum is TRUE, the UDP send operation will be offloaded.

    Hope this helps

    Dusty Harper [MSFT]
    Microsoft Corporation
    ------------------------------------------------------------
    This posting is provided "AS IS", with NO warranties and confers NO rights
    ------------------------------------------------------------
    Thursday, February 4, 2010 11:04 PM
    Moderator
  • what about receive operation?
    Friday, February 5, 2010 10:03 AM