NDIS 6 LWF: Changing Packet Size

NTDEV
1

Hi, I am experimenting with using an NDIS 6 Light-weight Filter (LWF) to insert 4-byte custom header inside the Ethernet frame. I understand that in the NDIS 5 Intermediate (IM) driver framework, this can be achieved by intercepting two OID requests (OID_GEN_MAXIMUM_FRAME_SIZE and OID_GEN_MAXIMUM_TOTAL_SIZE) and subtracting the reply values by 4 when passing the OID reply upwards.

However, when trying to do the same thing for NDIS 6 LWF, I observed that the OID_GEN_MAXIMUM_FRAME_SIZE does not go through the LWF. According to MS WDK 7600, it states that NDIS handles this OID query for NDIS 6.0 and later miniport drivers. I guess this explains why this OID is no longer requested in the NDIS 6 framework.

Fortunately, the OID_GEN_MAXIMUM_TOTAL_SIZE request and reply can be intercepted by the NDIS 6 LWF. However, even when I reduced the OID reply value from the miniport driver by 4, this modification does not seem to have any effect on the higher level drivers. They still send packets assuming the maximum 1500-byte Ethernet frame payload size.

I would like to inquire, other than intercepting and modifying the OID request for OID_GEN_MAXIMUM_TOTAL_SIZE, is there additional stuff I need to handle to change the packet size originating from higher level drivers?

Thank you. :slight_smile:

2

That sounds like an interesting project. I have not modified the MTU with a LWF myself, but I believe it can be done via the following procedure:

  1. Make sure to mark your LWF as a Modifying and Mandatory filter. If your filter is not Mandatory, then NDIS may bind TCPIP before your filter has a chance to attach and modify the MTU. Do this by setting these values in your INF:

HKR, Ndi,FilterType,0x00010001, 2 ; Modifying filter
HKR, Ndi,FilterRunType,0x00010001, 1 ; Mandatory filter

  1. In your filter’s FilterRestart handler, look in RestartParameters->RestartAttributes. This is a linked list of objects - find the object with ObjectID of OID_GEN_MINIPORT_RESTART_ATTRIBUTES. (The current version of NDIS only has a single Object ID in the list, so the sample filter takes the shortcut of assuming the first entry is a miniport restart attributes).

  2. Cast the restart attributes to an NDIS_RESTART_GENERAL_ATTRIBUTES. The sample’s FilterRestart function illustrates how to do this: http://code.msdn.microsoft.com/NDISLWFSYS-Sample-NDIS-60-42b76875/sourcecode?fileId=42729&pathId=1048232060 .

  3. Modify NDIS_RESTART_GENERAL_ATTRIBUTES::MtuSize to your new value.

  4. Continue with FilterRestart as normal.

3

Hi Jeffrey,

Yup, I have specified the LWF as both modifying and mandatory filter inside the INF file.

2,3,4,5.
Thanks for the advice! I will try them out and update this thread if it works.

4

Hi Jeffrey,

Thanks so much. Your advice worked!

I have verified that the IP header for all TCP packets now report a maximum payload of 1496 bytes, which is 4 bytes less than the true MTU of 1500 bytes.

5

Great, I’m glad your driver works. Also, thanks for replying back with your results, so now I can be more confident next time I suggest this technique. :slight_smile: