0

i was trying to get familiar with ndisproto samples in wdk. As per the doc, the -r -n 10 option should read 10 packets off the interface, but nothing in result even if I ping to the interface! The only time it reads traffic is when we use write option.

The sample is same, without any modification other than altering to #define NPROTO_PACKET_FILTER (NDIS_PACKET_TYPE_ALL_LOCAL|NDIS_PACKET_TYPE_PROMISCUOUS).

Is the driver really wired to read traffic originating from other sources?

What am I missing? Any idea how to read/sniff the traffic using ndisproto?

C:\Users\Administrator\Desktop\ndisprot>prottest.exe -r -n 10 \DEVICE\{17152850-6288-471A-9708-2889E7F55EE8}
 Option: NumberOfPackets = 10
Trying to access NDIS Device: \DEVICE\{17152850-6288-471A-9708-2889E7F55EE8}
Opened device \DEVICE\{17152850-6288-471A-9708-2889E7F55EE8} successfully!
Trying to get src mac address
GetSrcMac: IoControl success, BytesReturned = 14
Got local MAC: 00:0c:29:23:b1:09
DoReadProc


C:\Users\Administrator\Desktop\ndisprot>prottest.exe -w -n 1 \DEVICE\{17152850-6288-471A-9708-2889E7F55EE8}
 Option: NumberOfPackets = 1
Trying to access NDIS Device: \DEVICE\{17152850-6288-471A-9708-2889E7F55EE8}
Opened device \DEVICE\{17152850-6288-471A-9708-2889E7F55EE8} successfully!
Trying to get src mac address
GetSrcMac: IoControl success, BytesReturned = 14
Got local MAC: 00:0c:29:23:b1:09
DoWriteProc
DoWriteProc: sent 100 bytes
DoWriteProc: finished sending 1 packets of 100 bytes each
DoReadProc
DoReadProc: read pkt # 1, 100 bytes
DoReadProc finished: read 1 packets
Jimson James
  • 2,937
  • 6
  • 43
  • 78

1 Answers1

1

Got the answer at last. The reason is, the driver sample is specifically designed to send/receive EAP over LAN frames, not all. There are a couple of break statements in NdisprotReceiveNetBufferLists that prevents any other packets other than frames of ethertype 0x888E from reaching the client app.

Same is the case for send.

Jimson James
  • 2,937
  • 6
  • 43
  • 78
  • Thank you! I had this same problem. For anyone else, just search for NPROT_ETH_TYPE in the driver code and get rid of any checks that exist. – Dan Oct 02 '14 at 17:38