locked
NET_BUFFER_DATA_LENGTH at FWPM_LAYER_OUTBOUND_TRANSPORT_V4 Classify 8 Bytes Too Large RRS feed

  • Question

  • I am examining outbound UDP datagrams in the Classify callback for FWPM_LAYER_OUTBOUND_TRANSPORT_V4. The datagram length as returned from NET_BUFFER_DATA_LENGTH is always eight(8) bytes larger than it should be. For example, if an 8192-byte datagram is being sent, then the data length that I see at the classify callback is 8200. There is no similar problem with FWPM_LAYER_OUTBOUND_TRANSPORT_V4;it is OK.

    In examining the data the correct datagram data is included in the NB, but it is preceeded by 8 bytes that I don't understand.

    Anyone else seen this? Is there an offset that I am forgetting to account for?

    Thomas F. Divine

     


    Thomas F. Divine http://www.pcausa.com
    Friday, October 22, 2010 1:57 PM

Answers

  • Ok. I see that the extra eight(8) bytes are the UDP header. This is included in outbound, but not inbound.

    Sorry for the bandwidth...

    Thomas F. Divine

     


    Thomas F. Divine http://www.pcausa.com
    Friday, October 22, 2010 2:10 PM