Filter Driver: Get IP Address

Hi~,
I want to get IP address including IPv6 address in Filter Driver, and I try to use OID_GEN_NETWORK_LAYER_ADDRESSES OID to get the network layer addresses, but this OID is not supported in Win7 System (Ndis6.20). I am wondering are there any ways to get the current IP addresses of the Wireless NIC? Thanks~
Yaokee

The NDIS_FILTER_ATTACH_PARAMETERS provides some information, with possible
updates in NDIS_FILTER_RESTART_PARAMETERS. You can use that information to
call the kernel-mode IP Helper API to fetch the details you are looking for.

OID_GEN_NETWORK_LAYER_ADDRESSES is not a queryable OID. Your
FilterOidRequest routine can expect to see higher-level protocols make this
request to set addresses.

There may be other ways.

Thomas F. Divine
http://www.pcausa.com


From:
Sent: Wednesday, April 14, 2010 1:51 AM
To: “Windows System Software Devs Interest List”
Subject: [ntdev] Filter Driver: Get IP Address

> Hi~,
> I want to get IP address including IPv6 address in Filter Driver, and I
> try to use OID_GEN_NETWORK_LAYER_ADDRESSES OID to get the network layer
> addresses, but this OID is not supported in Win7 System (Ndis6.20). I am
> wondering are there any ways to get the current IP addresses of the
> Wireless NIC? Thanks~
> Yaokee
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

Take a look at Windows Filtering Platform, if your target OS is Vista+. WFP
can provide that information via a callout. You also do not need a kernel
driver to use WFP.

Gary G. Little
H (952) 223-1349
C (952) 454-4629
xxxxx@comcast.net

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yeah.net
Sent: Wednesday, April 14, 2010 12:52 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Filter Driver: Get IP Address

Hi~,
I want to get IP address including IPv6 address in Filter Driver, and I
try to use OID_GEN_NETWORK_LAYER_ADDRESSES OID to get the network layer
addresses, but this OID is not supported in Win7 System (Ndis6.20). I am
wondering are there any ways to get the current IP addresses of the Wireless
NIC? Thanks~
Yaokee


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

__________ Information from ESET Smart Security, version of virus signature
database 5028 (20100414) __________

The message was checked by ESET Smart Security.

http://www.eset.com

__________ Information from ESET Smart Security, version of virus signature
database 5028 (20100414) __________

The message was checked by ESET Smart Security.

http://www.eset.com

The IP Helper Function ‘GetUnicastIpAddressTable()’ gives you a table of both IPv4 and IPv6 for all adapters. The IP Helper Functions have the IP management APIs for all kinds of IP information.

Larry C

Ok, Thanks everyone~ But I want to get the address in Kernel level, any Kernel-mode IP helper APIs could be used to fetch the address I want?

On NT6, the IPHelper API is available in Kernel Mode.

On NT5, you can register for TDI client callbacks and TCPIP will notify you
via the callbacks of address changes. The name of the ‘transport’ (device
object) can be correlated to the Adapter by knowing the NetCfgId (adapter
GUID). This will get the address but not the netmask.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yeah.net
Sent: Friday, April 16, 2010 12:52 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Filter Driver: Get IP Address

Ok, Thanks everyone~ But I want to get the address in Kernel level, any
Kernel-mode IP helper APIs could be used to fetch the address I want?


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

If you would have checked the WDK you would have found that the IP Helper Function ‘GetUnicastIpAddressTable()’ IS a kernel function.

OK, thanks Larry and David~

Now, there is a problem about how to use this function.
My codes:
#include Netioapi.h

ADDRESS_FAMILY Family;
PMIB_UNICASTIPADDRESS_TABLE Table = NULL;
NETIOAPI_API NetIoApi = STATUS_NOT_FOUND;
Family = AF_INET;
NetIoApi = GetUnicastIpAddressTable(Family, (PMIB_UNICASTIPADDRESS_TABLE *)&(Table));…

But I get the LNK error 2019:unresolved external symbol _GetUnicastIpAddressTable@8

How could this happen?

Should I include Iphlpapi.lib ?

>From the WDK:

"Driver code that uses the kernel-mode IP Helper functions, MIB structures,
and enumerations that are declared in Netioapi.h must have #include
statements in the following sequence.

#include <ntddk.h>
#include <netioapi.h>
…"

Make sure you are using a Vista or later Build environment.

Good luck,

Thomas F. Divine
http://www.pcausa.com

--------------------------------------------------
From:
Sent: Saturday, April 17, 2010 12:06 AM
To: “Windows System Software Devs Interest List”
Subject: RE:[ntdev] Filter Driver: Get IP Address

> Now, there is a problem about how to use this function.
> My codes:
> #include Netioapi.h
> …
>
> ADDRESS_FAMILY Family;
> PMIB_UNICASTIPADDRESS_TABLE Table = NULL;
> NETIOAPI_API NetIoApi = STATUS_NOT_FOUND;
> Family = AF_INET;
> NetIoApi = GetUnicastIpAddressTable(Family, (PMIB_UNICASTIPADDRESS_TABLE
> *)&(Table));…
>
> But I get the LNK error 2019:unresolved external symbol
> _GetUnicastIpAddressTable@8
>
> How could this happen?
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer</netioapi.h></ntddk.h>

#include <ntddk.h>
#include <netioapi.h>
…"
Yes, I declare these header files in this order. and Build Environment is Win7</netioapi.h></ntddk.h>

No. Include netio.lib.

$(DDK_LIB_PATH)\netio.lib

( don’t know why it isn’t mentioned in the current WDK documentation…)

Thomas F. Divine
http://www.pcausa.com


From:
Sent: Saturday, April 17, 2010 12:25 AM
To: “Windows System Software Devs Interest List”
Subject: RE:[ntdev] Filter Driver: Get IP Address

> Should I include Iphlpapi.lib ?
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

OK, It works~ Thanks very much, Thomas!

It could happen if you do not specify the library to the linker to resolve
the import.

I think you need to add netio.lib to the TARGETLIBS in your SOURCES file.

Good Luck,
Dave Cattley

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yeah.net
Sent: Saturday, April 17, 2010 12:07 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] Filter Driver: Get IP Address

Now, there is a problem about how to use this function.
My codes:
#include Netioapi.h

ADDRESS_FAMILY Family;
PMIB_UNICASTIPADDRESS_TABLE Table = NULL;
NETIOAPI_API NetIoApi = STATUS_NOT_FOUND;
Family = AF_INET;
NetIoApi = GetUnicastIpAddressTable(Family, (PMIB_UNICASTIPADDRESS_TABLE
*)&(Table));…

But I get the LNK error 2019:unresolved external symbol
_GetUnicastIpAddressTable@8

How could this happen?


NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

Ok, now, All the unicast ip address entries on the local computer will be stored in a table, and I want to read the address for this struct:

typedef struct in_addr {
union {
struct {
u_char s_b1,s_b2,s_b3,s_b4;
} S_un_b;
struct {
u_short s_w1,s_w2;
} S_un_w;
u_long S_addr;
} S_un;
} IN_ADDR, *PIN_ADDR, FAR *LPIN_ADDR;

Of course, inet_ntoa() could convert a network address in a struct in_addr to a dots-and-numbers format string, and it is delcared in the header file Winsock2.h. And I have a test, there would be lots of compile erros if this header file included in the project. I am looking for a function with the same function of inet_ntoa(). [Win7-FilterDriver]
Thanks~

Ok, now, All the unicast ip address entries on the local computer will be stored in a table, and I want to read the address from this struct:

typedef struct in_addr {
union {
struct {
u_char s_b1,s_b2,s_b3,s_b4;
} S_un_b;
struct {
u_short s_w1,s_w2;
} S_un_w;
u_long S_addr;
} S_un;
} IN_ADDR, *PIN_ADDR, FAR *LPIN_ADDR;

Of course, inet_ntoa() could convert a network address in a struct in_addr to a dots-and-numbers format string, and it is delcared in the header file Winsock2.h. And I have a test, there would be lots of compile erros if this header file included in the project. I am looking for a function with the same function of inet_ntoa(). [Win7-FilterDriver]
Thanks~

Just fetch the bytes yourself and format them. Something along these lines:

DebugPrint( INFO, DBG_ROUTING,
“XYZ_ChangeRoutesCallback: IP: %d.%d.%d.%d\n”,
pByte[0], pByte[1], pByte[2], pByte[3]
);

Or just print the ULONG as hex. Doesn’t take a rocket scientist to convert
it to something meaningful.

Don’t try to be to fancy with strings and prints in the kernel.

Thomas F. Divine
http://www rawether.net


From:
Sent: Saturday, April 17, 2010 9:37 AM
To: “Windows System Software Devs Interest List”
Subject: RE:[ntdev] Filter Driver: Get IP Address

> Ok, now, All the unicast ip address entries on the local computer will be
> stored in a table, and I want to read the address from this struct:
>
> typedef struct in_addr {
> union {
> struct {
> u_char s_b1,s_b2,s_b3,s_b4;
> } S_un_b;
> struct {
> u_short s_w1,s_w2;
> } S_un_w;
> u_long S_addr;
> } S_un;
> } IN_ADDR, *PIN_ADDR, FAR *LPIN_ADDR;
>
> Of course, inet_ntoa() could convert a network address in a struct in_addr
> to a dots-and-numbers format string, and it is delcared in the header file
> Winsock2.h. And I have a test, there would be lots of compile erros if
> this header file included in the project. I am looking for a function with
> the same function of inet_ntoa(). [Win7-FilterDriver]
> Thanks~
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer

Hi Thomas, Thanks for your great and helpful suggestions.

Hell all ,

A related question , do we have any equivalent function for GetUnicastIpAddressTable() in Xp ? Because i am also trying something similar . I need to get the lP addresses of Wifi devices connected in Xp.

TIA,
Venkatesh.D.N