problem by accessing NBL at TRANSPORT LAYER RRS feed

  • Question

  • Hi, i ha ve a following problem .. I registered callout on in, out transport 
    layer and i want to get the whole packet data from ETHERNET HEADER (mean from 
    dest. mac, source mac, protocol ) ending with the data data ...
    i have tried this, but still get only the DATA portion :

    if (pendedPacket->direction == FWP_DIRECTION_INBOUND)

    pendedPacket->ipHeaderSize + pendedPacket->transportHeaderSize,

    netBuffer = NET_BUFFER_LIST_FIRST_NB(pendedPacket->netBufferList);

    packet = (UCHAR*) MmGetSystemAddressForMdlSafe(NET_BUFFER_CURRENT_MDL(netBuffer),HighPagePriority) + netBuffer->DataOffset;

    etc ..
    ----- in packet, there should be the whole packet from begginig of the IP. Header, but there is not. Where is the problem ? Could someone help ?
    thx for answers ..
    • Edited by Nakato Friday, November 6, 2009 1:42 PM removed unnecesary parts
    Tuesday, November 3, 2009 10:00 PM


  • You are not supposed to modify the length of NET_BUFFER directly -- the Ndis advance/retreat function adjusts it for you.

    Also MAC header can not be reliably retrieved from inbound TRANSPORT -- lower layer TCPIP processing could have removed it from the NBL already.

    NDIS LWF would be the driver type that's capable of inspect MAC headers (inbound & outbound).

    • Marked as answer by Nakato Friday, November 6, 2009 1:42 PM
    Thursday, November 5, 2009 9:10 AM