Choppy surfing question RRS feed

  • Question

  • I have built a filter driver based on the inspect example from the DDK. The key difference is that I send the ALE connect packets to user mode for a decision. I am using pended IRPs to pass the packets to user mode.


    The user mode app is a dos exe written in C++ and it simply returns the packets with a yes decision to allow the ALE flow. The driver then reinstates the ALE packet. The ALE filter is based on local ip address match.


    It all seems to be working in that the dos app is getting the packets, the decisions are being passed to the driver ok, but the end result is that surfing is choppy. To that end that some web pages do not load, some partially load and then freeze.

    Surely if all ALE connections are approved, and I have no callouts at any other layers this should put very little overhead on the system and be almost seamless.


    I know this is vague, but has anyone got any suggestions as to why I am getting these symptoms?

    Monday, June 6, 2011 5:12 PM

All replies

  • I was testing this morning. The ALE connections are estabished and http packets start to build the web page, but then it stops halfway through building the page, seemingly without rhyme or reason. The page www.itv.com stops during the VIEWSTATE tag.

    If this helps anyone help me I post a wireshark trace



    And also the contents of the page that actually downloaded




    As I say I am not filtering at any later below ALE, and the ALE flows are clearly being created. Why would the data packets just stop halfway through?

    Tuesday, June 7, 2011 8:24 AM