Jump-start your project by learning from devs who
write Windows drivers and file systems every day.
Take an OSR seminar!

OSR is Hiring! Click here to find out more.

Windows Internals & Software Drivers Lab, Santa Clara, CA 5-9 August, 2013
Kernel Debugging & Crash Analysis for Windows Lab, Santa Clara, CA 9-13 September, 2013
Upcoming OSR Seminars:
Writing WDF Drivers for Windows Lab, Boston, MA 7-11 October, 2013
Developing File Systems for Windows, Seattle, WA 5-8 November, 2013

Go Back   OSR Online Lists > ntdev
link NDIS Miniport Driver
Welcome, Guest
You must login to post to this list
  Message 1 of 32  
02 Jul 12 16:54
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
NDIS Miniport Driver
My miniport driver is working properly with send/receive. However, it does not have an ip address. 1. Is there anyway to have it get an ip address automatically? 2. What bytes should be reported on the network settings screen in windows? The number of directed packets?
  Message 2 of 32  
02 Jul 12 17:59
Calvin Guan
xxxxxx@gradovec.com
Join Date: 11 Oct 2009
Posts To This List: 380
Re: NDIS Miniport Driver
You need to have a functioning DHCP server on the network if you don't want to assign static IP. Of course, you need to have TCPIP bound to your miniport. If you are still not getting IP address, you need to hookup a shark trace to debug the DHCP protocol. Directed packet means packet directed to your MAC address. You don't count MC or BC packets. On Mon, Jul 2, 2012 at 1:53 PM, <xxxxx@gmail.com> wrote: > My miniport driver is working properly with send/receive. However, it does > not have an ip address. > > 1. Is there anyway to have it get an ip address automatically? > > 2. What bytes should be reported on the network settings screen in > windows? The number of directed packets? > > --- > NTDEV is sponsored by OSR <...excess quoted lines suppressed...> --
  Message 3 of 32  
09 Jul 12 14:56
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
NDIS Miniport Driver
My driver is successfully sending and receiving data. However, I'm having a hard time testing directed packet transmission and reception. When I connect my test hardware directly to the Intel Ethernet jack on my machine, set them up with static IP address, and use ping, I can see the packets being sent and received. However, the packets are broadcast packets, and not directed packets (at least this is what ETH_IS_BROADCAST tells me in my code). 1. What is a good way to test for directed packets? 2. Should I be seeing 'Destination host unreachable' as the response on ping? 3. My test hardware doesn't set an automatic IP address even though our network assigns IPs dynamically....what could be the problem? Does it have something to do with a missing OID? Thanks for your help.
  Message 4 of 32  
09 Jul 12 15:03
Pavel A
xxxxxx@fastmail.fm
Join Date: 21 Jul 2008
Posts To This List: 1892
Re: NDIS Miniport Driver
On 09-Jul-2012 21:57, xxxxx@gmail.com wrote: > My driver is successfully sending and receiving data. However, I'm having a hard time testing directed packet transmission and reception. When I connect my test hardware directly to the Intel Ethernet jack on my machine, set them up with static IP address, and use ping, I can see the packets being sent and received. However, the packets are broadcast packets, and not directed packets (at least this is what ETH_IS_BROADCAST tells me in my code). > > 1. What is a good way to test for directed packets? NdisTest (part of the test kit) > 2. Should I be seeing 'Destination host unreachable' as the response on ping? No. Tcpip believes that it has path to the destination. > 3. My test hardware doesn't set an automatic IP address even though our network assigns IPs dynamically....what could be the problem? Does it have something to do with a missing OID? What means "automatic IP" - APIPA or DHCP? -- pa
  Message 5 of 32  
09 Jul 12 15:07
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
@Pavel It assigns IP address using DHCP I think.
  Message 6 of 32  
10 Jul 12 12:14
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
In my trace, I am getting a DHCP discover, but not a DHCP offer...what could be the problem?
  Message 7 of 32  
10 Jul 12 13:08
David R. Cattley
xxxxxx@msn.com
Join Date: 09 Jul 2002
Posts To This List: 1806
RE: NDIS Miniport Driver
Is that capture done on the system sending the Discover or on the DHCP server (or a monitor port on the switch)? The first thing to establish is that the discover actually was observed by a (the) DHCP server from which you expect the offer to come from. Good Luck,Dave Cattley --
  Message 8 of 32  
10 Jul 12 14:25
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
I will check that out @David. Thanks. Also, I am not updating the link state right now. It is currently always set as connected (still determining how to query link state from the hardware). Would this effect it in any way?
  Message 9 of 32  
10 Jul 12 17:37
David R. Cattley
xxxxxx@msn.com
Join Date: 09 Jul 2002
Posts To This List: 1806
RE: NDIS Miniport Driver
> It is currently always set as connected That is unlikely to prevent packet flow so I would not immediately expect this to be related. However, the incredibly helpful !ndiskd.miniport extension run in Windbg and pointed at your miniport will tell you for certain if NDIS thinks your 'connected' state is actually sufficient to have the wrapper pass your receive traffic to bound protocols. I suggest you have a go with that. Good Luck, Dave Cattley
  Message 10 of 32  
11 Jul 12 17:56
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
I installed wireshark on two machines and did the following: Ping from the test machine (test hardware) to my test server (Intel NIC), and saw the broadcast ARP being sent out. However, on the test server, the packets are never received.... Any thoughts?
  Message 11 of 32  
11 Jul 12 18:27
Pavel A
xxxxxx@fastmail.fm
Join Date: 21 Jul 2008
Posts To This List: 1892
Re: NDIS Miniport Driver
On 12-Jul-2012 00:57, xxxxx@gmail.com wrote: > I installed wireshark on two machines and did the following: > > Ping from the test machine (test hardware) to my test server (Intel NIC), and saw the broadcast ARP being sent out. However, on the test server, the packets are never received.... > > Any thoughts? And what do you think? It is something in your driver. The Intel's NIC probably is good. By the way, use a real hub to connect the machines, not a cross-cable. -- pa
  Message 12 of 32  
12 Jul 12 18:36
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
When I ping from my server (INTEL NIC) to my test client (test hardware), I am able to receive a ping, and an ACK is transmitted out (I can see this in wireshark), however, a direct packet is never received on the server side. Same thing if I send out (ping) a packet from my test client to my server. I can see the transmit show up in wireshark on my test client, but no packet received on my server side. Is it safe to assume that this is a hardware problem, and the packets aren't actually being sent by the hardware???
  Message 13 of 32  
12 Jul 12 19:08
David R. Cattley
xxxxxx@msn.com
Join Date: 09 Jul 2002
Posts To This List: 1806
RE: NDIS Miniport Driver
I think you can only safely assume that the driver/hardware combination is failing to send packets. You can argue that out with the HW folks. This is your NIC hardware right? I don't know how folks on the list could tell you it is a HW failure. Good Luck, Dave Cattley
  Message 14 of 32  
12 Jul 12 19:11
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
@David I only ask this because the packets are being reported in Wireshark. I'm meeting with the hardware guys to check this problem out soon. However, I think I really want to know whether packets reported in wireshark are packets reported to NDIS by the miniport driver????
  Message 15 of 32  
12 Jul 12 19:44
David R. Cattley
xxxxxx@msn.com
Join Date: 09 Jul 2002
Posts To This List: 1806
RE: NDIS Miniport Driver
Wireshark (via WinPCAP) shows packets presented to its protocol/adapter binding by NDIS. Wireshark commands WinPCAP to place that binding into promiscious mode by default or at least to set the packet filter to enable all local packets (that is, sent & received). However, a 'sent' packet in Wireshark (or NetMon3) is only evidence that the packet made it as far as the NDIS miniport 'wrapper' around your miniport code. The logic to take a send and loop it back as a receive into a binding with the packet filter set to promiscious (or local) is all NDIS code. Your Miniport could be hopelessly broken in the TX path and yet NDIS would make someone reading the capture think "hey, the packet got sent". That is, if your capture is being taken on the machine doing the sending. Which I assume you are doing. Because if you saw this packet in a capture taken from an independent machine then you would not be having a chat with the HW guys. So sorry, your capture in hand is not terribly strong evidence that the driver is doing anything other than loading, returning from Miniport Initialize, and responding to a few boilerplate OIDs. It does not say much about your TX path. But don't show them this note. Go in gun's a blazing. Of course it?s the hardware :) Good Luck, Dave Cattley
  Message 16 of 32  
12 Jul 12 19:56
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
Thanks Dave. On the receive side, if I am seeing the packets in wireshark, it's safe to assume those packets are being processed, since my driver is the one passing the data to NDIS correct? I'm also assuming that one of the higher level drivers is the one that instructs my driver to transmit an ACK packet? Thanks.
  Message 17 of 32  
12 Jul 12 23:11
David R. Cattley
xxxxxx@msn.com
Join Date: 09 Jul 2002
Posts To This List: 1806
RE: NDIS Miniport Driver
<quote> On the receive side, if I am seeing the packets in wireshark, it's safe to assume those packets are being processed, since my driver is the one passing the data to NDIS correct? </quote> Absolutely. There is no way that packet can get into the system unless it goes through your driver. <quote> I'm also assuming that one of the higher level drivers is the one that instructs my driver to transmit an ACK packet? </quote> Yes again. By ACK I think you mean 'response' in so far as I think you said you were using ICMP (Ping). The 'response' would be an ICMP Echo Reply. Since the system is not actually getting TX traffic 'to the wire' TCP (for example) would not get to 'ACK' packets (only as far as SYN-ACK in the handshake at best). Good Luck, Dave Cattley
  Message 18 of 32  
13 Jul 12 12:40
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
Thanks Dave! This is my first NDIS driver, and it's been a while since I utilized my networking knowledge. Nice to know I'm halfway there...
  Message 19 of 32  
16 Jul 12 16:14
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
For some reason my transmits started working (i have no idea). Anyway, whenever I ping with packets 1000 bytes or >, I get a request timeout. Any suggestions?
  Message 20 of 32  
16 Jul 12 18:12
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
Also, I'm still not able to get an IP address from DHCP. I see the request being sent out...but no response. However, pings work, and so I've assumed that transmit is working correctly now.
  Message 21 of 32  
19 Jul 12 13:14
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
I started my own DHCP server, and checked to see if my miniport driver sends out DHCP requests. It never sends out a request. When I hook it up to my other NIC (INTEL NIC), I see the request being sent out, and an IP address is assigned. Any idea why my driver isn't sending out a request?
  Message 22 of 32  
19 Jul 12 14:43
Pavel A
xxxxxx@fastmail.fm
Join Date: 21 Jul 2008
Posts To This List: 1892
Re: NDIS Miniport Driver
On 19-Jul-2012 20:13, xxxxx@gmail.com wrote: > I started my own DHCP server, and checked to see if my miniport driver sends out DHCP requests. It never sends out a request. When I hook it up to my other NIC (INTEL NIC), I see the request being sent out, and an IP address is assigned. > > Any idea why my driver isn't sending out a request? > Even three ideas... a. It is in your code, b. It is in your hardware c. something wrong between your seat and keyboard ;) -- pa
  Message 23 of 32  
24 Jul 12 16:36
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
Ok. Whenever packets are fragmented, i.e. > 1480 bytes, they are reassembled on receive. makes sense. However, when my driver sends a response back to a ping, the fragments it sends are big, and I'm guessing bigger than the maximum MTU size of my switch. Thus, the response is never sent. Where in NDIS do you tell it the max size of a frame that can be sent???
  Message 24 of 32  
25 Jul 12 09:49
Pavel A
xxxxxx@fastmail.fm
Join Date: 21 Jul 2008
Posts To This List: 1892
Re: NDIS Miniport Driver
On 24-Jul-2012 23:35, xxxxx@gmail.com wrote: > Where in NDIS do you tell it the max size of a frame that can be sent??? > OID_GEN_MAXIMUM_FRAME_SIZE OID_GEN_MAXIMUM_TOTAL_SIZE -- pa
  Message 25 of 32  
25 Jul 12 12:34
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
Thanks. I figured this out. I set my max frame length as 1514, however, when my driver transmits data, (for example, a reply ping), the size of the fragments (NET BUFFERS) are 1522...this is before it even hits my hardware. Any idea what is happening?
  Message 26 of 32  
25 Jul 12 19:52
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
I realized I was not accounting for the ethernet header in mtu_size and lookahead_size. I set both to 1514 - sizeof(ETHERNET_HEADER), which is 14 bytes.... Now when I send 10000 bytes, wireshark shows the 1514 byte fragments being sent, however, the first fragment received is received with a length of 1510, meaning 4 bytes were lost in transition. Is it safe to assume this is a hardware problem? This only happens when packets are fragmented. When I send small packets, i.e. size of 100 bytes, wireshark shows a successful send/receive of 100 bytes.
  Message 27 of 32  
25 Jul 12 20:43
David R. Cattley
xxxxxx@msn.com
Join Date: 09 Jul 2002
Posts To This List: 1806
RE: NDIS Miniport Driver
You could always set the value to 4 octets less than the actual value and see if the 1510 octet frames that you then get from the system get sent properly. > Is it safe to assume this is a hardware problem? I guess it is likely that or a 'how the driver programs the hardware' problem. You can control the size of ICMP echo request packets with PING. You should be able to generate all frame sizes between 1500 to 1514. Is it just 1514 that gets truncated by 4 octets? What about 1513, 1512, 1511, etc.? Do they get truncated to 1510, or <frame-size>-4? Good Luck, Dave Cattley
  Message 28 of 32  
25 Jul 12 20:49
ntdev member 45059
xxxxxx@pmatrix.com
Join Date:
Posts To This List: 320
RE: NDIS Miniport Driver
4 bytes sounds like an 802.1Q vlan header, which generally don't show up with software sniffers. Jan -----Original Message----- From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of David R. Cattley Sent: Wednesday, July 25, 2012 5:42 PM To: Windows System Software Devs Interest List Subject: RE: [ntdev] NDIS Miniport Driver You could always set the value to 4 octets less than the actual value and see if the 1510 octet frames that you then get from the system get sent properly. > Is it safe to assume this is a hardware problem? I guess it is likely that or a 'how the driver programs the hardware' problem. You can control the size of ICMP echo request packets with PING. You should be able to generate all frame sizes between 1500 to 1514. Is it just 1514 that gets truncated by 4 octets? What about 1513, 1512, 1511, etc.? Do they get truncated to 1510, or <frame-size>-4? Good Luck, Dave Cattley --- NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
  Message 29 of 32  
25 Jul 12 21:14
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
It's weird. Could it have something to do with alignment? My hardware requires the data buffer pointer to be at an adress aligned on a 16-byte boundary. The elements described in the PSCATTER_GATHER_LIST aren't on 16-byte boundaries. Is there any way to set this????
  Message 30 of 32  
25 Jul 12 21:54
ntdev member 45059
xxxxxx@pmatrix.com
Join Date:
Posts To This List: 320
RE: RE:NDIS Miniport Driver
Fragments for network packets I believe can be on arbitrary byte boundaries, and there is no way to force 16-byte alignment. If you have network hardware that can't do this it's broken. If your hardware requires this, you could copy the packet fragments into temporary buffers with your alignment requirements. Things like command/status ring buffers in common memory, might be ok with larger alignment requirements because your driver will be allocating them. Jan -----Original Message----- From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@gmail.com Sent: Wednesday, July 25, 2012 6:13 PM To: Windows System Software Devs Interest List Subject: RE:[ntdev] NDIS Miniport Driver It's weird. Could it have something to do with alignment? My hardware requires the data buffer pointer to be at an adress aligned on a 16-byte boundary. The elements described in the PSCATTER_GATHER_LIST aren't on 16-byte boundaries. Is there any way to set this???? --- NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
  Message 31 of 32  
27 Jul 12 11:00
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
Thank Jan! The problem was my hardware. It expected a 16 byte aligned data ptr, and the address I was providing from scatter/gather (SCATTER_GATHER_ELEMENT[0] for example) was not 16 byte aligned. For a temporary fix, I created my own buffer and did local data copying. This, however, is a very BAD design, as this slows down transmit processing. I am working on a fix, either in hardware, or software.
  Message 32 of 32  
27 Jul 12 17:37
Robert Graham
xxxxxx@gmail.com
Join Date: 29 Mar 2012
Posts To This List: 149
RE: NDIS Miniport Driver
It was a problem in the hardware. Problem successfully fixed. My driver now correctly sends and receives packets.
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 01:02.

Contact Us - Osr Online Homepage - Top

Copyright ©2012, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license