"PCAGizmo" NDIS OID Monitor V1.00.00.12 September 12, 2006 Release Notes Printing Communications Associates, Inc. 4201 Brunswick Court Smyrna, GA 30080 USA TEL: (770) 432-4580 (Primary) FAX: (770) 436-7246 http://www.pcausa.com WARNING!!! ========== Understand that PCAGizmo will install device drivers on your system. These drivers are experimental (pre-Alpha) and have not been tested as thoroughly as standard PCAUSA products. They have been tested in-house to a limited extent and has been provided to several external users when requested. So far, no problems have been reported. Understand also that at this point Vista RC1 is not bug-free. In fact, during development of the PCAGizmo Vista version a few relatively minor NDIS bugs were found and reported to the NDIS 6 team. It is necessary to provide this WARNING concerning the software included with PCAGizmo: IMPORTANT WARNING: Use at your own risk!!! UPGRADING TO NEW DRIVER VERSIONS ================================ Because this software is under development it is very strict about exact application/driver version matches. If you have an earlier version of NDIS Monitor then you must uninstall the previous PCAGizmo driver before installing this new version. OVERVIEW ======== PCAGizmo consists of a Win32 console application and two companion NDIS filter drivers: NDISMon.exe - The Win32 console application that fetches and displays the current log buffer. PCAGizmo5.sys - A NDIS 5 Intermediate (IM) filter driver. PCAGizmo6.sys - a NDIS 6 Lightweight Filter (LWF) monitoring driver. In its current state is it capable of logging NDIS query and set information operations as well as some NDIS Status operations. INSTALLATION ============ This version of PCAGizmo is installed using a Windows Installer MSI file. Running the installer will install PCAGizmo components and the correct companion driver. When PCAGizmo is installed the companion NDIS filter drivers will bind to all Ethernet miniports (including NDIS 5 802.11 miniports). On Vista the NDIS filter driver will also bind to native 802.11 miniports. These drivers are currently not digitally signed, so there may be several warnings about unsigned drivers during installation. If your system has multiple adapters then you may not be interested in monitoring OID operations on all adapters. We recommend that you use the Network Control Panel to "Uncheck" the PCAGizmo driver from adapters that you are not interested in monitoring, and then re-boot. UNINSTALL ========= Use the Windows Add/Remove programs feature to remove PCAGizmo and the companion NDIS drivers. You need to reboot before the PCAGizmo driver is fully functional. After rebooting you should verify that your Internet connectivity still operates correctly. NDISMon USAGE ============= The NDISMon application is w Win32 console application. You will have to open a Command Prompt window ti use NDISMon. IMPORTANT!!! You must be running as Administrator to use NDISNom!!! On Vista you will have to use the "Run as Administrator" UAC feature when running the COmmand Prompt window. Id this is not done. NDISMon will not be able to communicate with the companion NDIS filter driver. NDISMon is located in this folder: \Windows\Program Files\PCAUSA\PCAGizmo The PCAGizmo driver automatically begins logging information on all bound adapters as soon as the system boots. When you run the NDISMon application if enumerates all of the PCAGizmo bindings and displays a simple adapter chooser. A list of adapters bound to the PCAGizmo driver is presented and then the user selects the desired adapter by entering the Adapter Number. Here is an example NDISMon adapter chooser screen: C:\Program Files\PCAUSA\PCAGizmo>ndismon > RealTek-Lower.log Bindings On PCAGizmo Driver: Adapter No. 1 "{A10855FE-0283-4D6E-8C8E-CCEE670A1CD1}-{5E53E0AF-679C-4C13-9EC3-AA4B1B191473}-0002" "\DEVICE\{A10855FE-0283-4D6E-8C8E-CCEE670A1CD1}" Adapter Name.....: {A10855FE-0283-4D6E-8C8E-CCEE670A1CD1} Description......: Realtek 8185 Extensible 802.11b/g Wireless Device IP Address.......: 192.168.1.113 Description: " Microsoft" Medium: 802.3 Mac address = 00-0E-2E-81-AD-E5 Media Connect State: UNKNOWN Adapter No. 2 "{A10855FE-0283-4D6E-8C8E-CCEE670A1CD1}-{5E53E0AF-679C-4C13-9EC3-AA4B1B191473}-0001" "\DEVICE\{A10855FE-0283-4D6E-8C8E-CCEE670A1CD1}" Adapter Name.....: {A10855FE-0283-4D6E-8C8E-CCEE670A1CD1} Description......: Realtek 8185 Extensible 802.11b/g Wireless Device IP Address.......: 192.168.1.113 Description: " Microsoft" Medium: 802.3 Mac address = 00-0E-2E-81-AD-E5 Media Connect State: UNKNOWN .... Adapter No. 5 "{A10855FE-0283-4D6E-8C8E-CCEE670A1CD1}-{5E53E0AF-679C-4C13-9EC3-AA4B1B191473}-0000" "\DEVICE\{A10855FE-0283-4D6E-8C8E-CCEE670A1CD1}" Adapter Name.....: {A10855FE-0283-4D6E-8C8E-CCEE670A1CD1} Description......: Realtek 8185 Extensible 802.11b/g Wireless Device IP Address.......: 192.168.1.113 Description: " Realtek" Medium: 802.3 Mac address = 00-0E-2E-81-AD-E5 Media Connect State: UNKNOWN Enter Adapter Number: 5 When the adapter number is entered NDISMon a prompt is displayed explaining that pressing Ctrl-C will exit the application. Then press any key to start the logging process. NDISMon then fetches the current log information for the selected adapter and outputs log information to the console. I normally redirect the log output to a file and examine it with an editior. Here is a typical command that I use: C:> NDISMon > oidlog.txt NDISMon will continue to log data on the specified adapter until Ctrl-C is pressed. Press Ctrl-C to stop logging and then examine the logged text file. This version of NDISMon and PCAGizmo only logs NDIS requests and NDIS Status indications. If you have suggestions for improvement of NDISMon and/or PCAGizmo, please let me know. (I know it needs a fancy GUI interface...). LOG INTERPRETATION ================== A few entries from a typical log are found below. More examples NDISMon can be found at: http://ndis.com/papers/802_11_logs/PCAGizmo_Wireless_OID_Logs.htm Here are a few clues for interpreting the log output: Seq No. 0002 This is the beginning of a sequence of operations to query on OID OID_GEN_MAXIMUM_LOOKAHEAD. This is the entry to the MiniportQueryInformation handler. Seq No. 0003 The MPQueryInformation handler calls NdisRequest. Seq No. 0004 The MPQueryInformation handler exits ( the '1') with status pending. Seq No. 0005 The ProtocolRequestComplete handler is called with the result. Seq No. 0006 The ProtocolrequestComplete handler calls NdisMQueryInformationComplete to indicate the results to the higher level. EXAMPLE LOG =========== NDIS Monitor Log Viewer V1.00.00.01 Copyright (c) 2003-2004 Printing Communications Assoc., Inc. (PCAUSA) All rights reserved. Driver Bindings: "\Device\{93EF1FE0-24BA-40F1-9741-5DF136B3AB55}" "\DEVICE\{248F7EF9-F928-4CCD-918B-0441052A31DF}" Description: " Intel(R) 82559 Fast Ethernet LAN on Motherboard" Medium: 802.3 Mac address = 00-30-6E-1E-3A-D0 Media Connect Status: Connected 0001 65.704607 sec InitializeHandler(0) 36 Bytes 0002 65.704659 sec QueryInformationHandler(0) 56 Bytes Oid : OID_GEN_MAXIMUM_LOOKAHEAD(0x00010105) - Query Information IB Len: 4; Needed: 0; W/R: 0 0003 65.704660 sec NdisRequest(0) 56 Bytes Oid : OID_GEN_MAXIMUM_LOOKAHEAD(0x00010105) - Query Information IB Len: 4; Needed: 0; W/R: 0 0004 65.704670 sec QueryInformationHandler(1) 56 Bytes Oid : OID_GEN_MAXIMUM_LOOKAHEAD(0x00010105) - Query Information Status: NDIS_STATUS_PENDING (0x00000103) IB Len: 4; Needed: 0; W/R: 0 0005 65.704755 sec RequestCompleteHandler(0) 60 Bytes Oid : OID_GEN_MAXIMUM_LOOKAHEAD(0x00010105) - Query Information Status: NDIS_STATUS_SUCCESS (0x00000000) IB Len: 4; Needed: 0; W/R: 4 Information( 4 Bytes): 512 (0x00000200) 0006 65.704757 sec NdisMQueryInformationComplete(0) 60 Bytes Oid : OID_GEN_MAXIMUM_LOOKAHEAD(0x00010105) - Query Information Status: NDIS_STATUS_SUCCESS (0x00000000) IB Len: 4; Needed: 0; W/R: 4 Information( 4 Bytes): 512 (0x00000200) 0007 65.704769 sec QueryInformationHandler(0) 56 Bytes Oid : OID_GEN_MAC_OPTIONS(0x00010113) - Query Information IB Len: 4; Needed: 0; W/R: 0 0008 65.704771 sec NdisRequest(0) 56 Bytes Oid : OID_GEN_MAC_OPTIONS(0x00010113) - Query Information IB Len: 4; Needed: 0; W/R: 0 0009 65.704774 sec QueryInformationHandler(1) 56 Bytes Oid : OID_GEN_MAC_OPTIONS(0x00010113) - Query Information Status: NDIS_STATUS_PENDING (0x00000103) IB Len: 4; Needed: 0; W/R: 0 0010 65.704859 sec RequestCompleteHandler(0) 60 Bytes Oid : OID_GEN_MAC_OPTIONS(0x00010113) - Query Information Status: NDIS_STATUS_SUCCESS (0x00000000) IB Len: 4; Needed: 0; W/R: 4 Information( 4 Bytes): 717 (0x000002CD) 0011 65.704859 sec NdisMQueryInformationComplete(0) 60 Bytes Oid : OID_GEN_MAC_OPTIONS(0x00010113) - Query Information Status: NDIS_STATUS_SUCCESS (0x00000000) IB Len: 4; Needed: 0; W/R: 4 Information( 4 Bytes): 709 (0x000002C5) PCAGizmo Website ================ Visit: http://www.pcausa.com/Utilities/PCAGizmo/PCAGizmo.htm