IP Packet Redirector
NDIS IM Sample Notes

 

This sample adds a mechanism that allows a Win32 application to interact with packets as they pass through the NDIS IM driver.

Virtual Adapter And Lower Adapter Interfaces

.For each NDIS IM driver binding there are actually two logical "adapter" interfaces:

bulletLowerAdapter - A logical interface to the "real" adapter that the NDIS IM driver binds to at it's lower "protocol" edge.
bulletVirtual Adapter - The a logical interface associated with the virtual adapter that the NDIS IM driver presents to other protocols at its upper "miniport" edge.

Here is an illustration of the Packet Redirector NDIS IM driver when it is installed between TCP/IP and a miniport driver:

 

The API provided with the Packet Redirector allows a Win32 application to open a handle to either (or both) of these adapter interfaces:

bulletPCASIM_OpenLowerAdapter - Opens a handle associated with the lower or "real" adapter using the "Adapter Name".
bulletPCASIM_OpenVirtualAdapter - Opens a handle associated with the upper or "virtual" adapter using the "AdapterName".

One can read and write on either of these adapter handles using these API functions:

bulletPCASIM_ReadOnAdapter - Reads a selected packet on the specified handle.
bulletPCASIM_WriteOnAdapter - Writes a packet on the specified handle.

 

I/O on Packet Redirector Lower Adapter Handle

It should be easy to understand read/write operations on a PCASIM lower adapter handle.
 
bulletWrites on a PCASIM lower adapter handle are translated to NdisSend calls to the lower "real" adapter and result in packets being sent on the network.
 
bulletReads on the lower adapter handle allow the Win32 application to read a selected packet that was being received or indicated from the lower adapter.
 

This is illustrated below:

 

I/O on Packet Redirector Virtual Adapter Handle

Yes, the Packet Redirector API is fully symmetrical. This means that one can also read and write on a virtual adapter handle.

However, in this case the behavior is "upside-down":

It should be easy to understand read/write operations on a PCASIM lower adapter handle.

bulletWrites on a virtual adapter handle will cause a packet to be injected and travel "upwards" to higher-level protocols as if it had been received from the network..
 
bulletReads on a virtual adapter handle actually operate on packets being send from the higher-level protocols.
 

This is illustrated below:

 

 

IP Packet Filter For Reading On Packet Redirector Adapter Handles

A mechanism is provided that allows the Win32 application to pass a filter to the driver to specify which IP packets can be read. The filter is list of IP Source/Destination address ranges and an "action" to be performed on packets that match the filter criteria. The actions can be combinations of:

bulletBLOCK - Have the NDIS IM driver drop the matching packet from the normal packet flow.
bulletREDIRECT - Have the NDIS IM driver pass a copy of the received packet to the Win32 application through the PCASIM_ReadOnPacket mechanism.

For example, the combination of BLOCK and REDIRECT actions cause a matching packet to be be diverted up to the Win32 application for processing. The REDIRECT action allows the Win32 application to monitor the packet while allowing it to also pass up to higher level protocols for ordinary processing.

Other Features

bulletDriver buffering (queuing) of received packets by the NDIS IM driver.

Sample Applications

Here are the current test applications provided to test the IP Packet Redirector sample:

bulletPRTest1 - Illustrates setting an IP Filter to block sending of selected IP packets.
bulletPRTest2 - Monitors selected IP packets as they are being sent.
bulletPRTest3 - Redirects selected PING requests to Win32 where they are echoed.
bulletPRTest4 - Monitors reception of selected IP packets as they are received.
bulletPRTest5 - All IP packets sent or received are looped through a Win32 application.

These are Win32 console applications.

For some tests you must use Ctrl-C to exit the program. This is a simple way to terminate the application and has the additional virtue of testing the driver I/O cancellation and cleanup logic.

 

PCAUSA Home · Privacy Statement · Products · Ordering · Support · Utilities · Resources
Mailing Lists  · PCAUSA Newsletter · PCAUSA Discussion List
 
Rawether for Windows and WinDis 32 are trademarks of Printing Communications Assoc., Inc. (PCAUSA)
Microsoft, MS, Windows, Windows 95, Windows 98, Windows Millennium, Windows 2000, and Win32 are registered trademarks and Visual C++ and Windows NT are trademarks of the Microsoft Corporation.
Send mail to webmaster@pcausa.com with questions or comments about this web site.
Copyright © 1996-2008 Printing Communications Assoc., Inc. (PCAUSA)
Last modified: December 31, 2007