Windows Millennium
TCP/IP Changes Cause
Some NDIS Filtering Products
To Fail

 

Knowledge Base ID

KB08080002
Category INFORMATION

Effected Product

NDIS, NDIS Filter Drivers

Effected Versions

N/A
Effected Platforms Windows ME

Symptoms

With RC1 of Windows ME Microsoft introduced significant changes to the base Windows 9X NDIS architecture. These changes are known to break a variety of NDIS products that work properly on platforms ranging from Windows 95 Gold through Windows ME.

Although the total effect of the Windows ME design changes from Microsoft are not yet known, it is certain that certain types of NDIS software will fail.

It is known, for example, that NDIS packet filters that operate by hooking the NDIS library (using documented Microsoft system services and techniques) will fail. The PCAUSA NDIS PIM 9X driver is one of many NDIS filter products that are expected not to work on the Windows ME platform.

The following BOOLEAN statement is TRUE for low-level network developers:

( (Windows ME != Windows 9X) && (Windows ME != Windows NT) && (Windows ME != Windows 2000) )

 

Cause

The Windows 9X NDIS wrapper is implemented in the NDIS.VXD virtual device driver (VxD). On the Windows 9X and Windows Millennium platforms NDIS exports its wrapper services two ways:

bulletVxD Service Table - For use by "legacy" NDIS drivers, including "Full MAC" NDIS NIC drivers and NDIS protocols implemented as VxDs.
bulletPortable Executable (PE) Exports - For use by NDIS "miniport drivers", including miniport NIC drivers and some NDIS protocol drivers.

The big change that was introduced with Windows Millennium was a big change to the TCP/IP networking components. One aspect of this change is that the TCP/IP protocol driver(s) switched from interfacing with the NDIS wrapper using the NDIS VxD service table to using the NDIS PE export table.

Although Windows Millennium preserves the Windows 9X NDIS VxD services, key Microsoft networking components appear to bypass the NDIS VxD services. For example, the Windows ME Microsoft TCP/IP transport driver does not call the NdisRegisterProtocol or NdisOpenAdapter NDIS VxD services. Since hooking these services is essential to the operation of some types of NDIS packet filters (including PCAUSA's NDIS PIM 9X versions prior to V2.01.02.09), these filters will not operate correctly on Windows ME.

 

Resolution

There are two approaches to providing packet filtering of MSTCP on Windows Millennium:

bulletUse a NDIS Intermediate Driver
bulletHook Using PELDR Hooking Techniques

 

The PCAUSA NDIS IM driver sample V2.01.02.09 and higher hook both the NDIS VxD service table and the NDIS PE export table. With this enhancement NDIS PIM provides NDIS filtering capability on platforms ranging from Windows 95 through Windows Millennium.

 

Status

November 20, 2000 Corrected and Updated.
August 8, 2000 Information posted.

 

Comments

Please click the following link to send e-mail relating to this PCAUSA Knowledge Base topic:

<Send Mail To KB08080002 Technical Contact>

 

Keywords NDIS Packet Filter, NDIS PIM 9X
Created August 8, 2000
Last Reviewed February 2, 2001

 
 

PCAUSA Home · Privacy Statement · Products · Ordering · Support · Utilities · Resources
Mailing Lists  · PCAUSA Newsletter · PCAUSA Discussion List
 
Rawether for Windows and WinDis 32 are trademarks of Printing Communications Assoc., Inc. (PCAUSA)
Microsoft, MS, Windows, Windows 95, Windows 98, Windows Millennium, Windows 2000, and Win32 are registered trademarks and Visual C++ and Windows NT are trademarks of the Microsoft Corporation.
Send mail to webmaster@pcausa.com with questions or comments about this web site.
Copyright © 1996-2008 Printing Communications Assoc., Inc. (PCAUSA)
Last modified: December 31, 2007