On Jan 14, 2005, at 5:14 PM, Ed Remmell wrote:
If the adapter isn't being opened in promiscuous mode (!promisc), then the
hardware filters should be minimally set to:
(NDIS_PACKET_TYPE_BROADCAST | NDIS_PACKET_TYPE_DIRECTED | NDIS_PACKET_TYPE_ALL_LOCAL)
Currently, the winpcap code sets this to just NDIS_PACKET_TYPE_ALL_LOCAL. We
have found that we couldn't receive an ARP broadcast packet
Do you mean an ARP broadcast packet received by the machine running an NDIS application or one *sent* by that machine?
unless we also set NDIS_PACKET_TYPE_BROADCAST.
The page at
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ network/hh/network/22genoid_0e779a21-972c-4ec7-ac9d- abc6e9dbd180.xml.asp
says of NDIS_PACKET_TYPE_ALL_LOCAL:
All packets sent by installed protocols and all packets indicated by the NIC that is identified by a given NdisBindingHandle.
I would read that as meaning that it sees
1) all outgoing packets (take *that*, Sun Microsystems DLPI developers!)
and
2) all incoming packets seen by the NIC in question
except for incoming packets that are processed entirely in the driver rather than "[being] forwarded to the appropriate bound protocol driver(s)", to quote the NdisMIndicateReceivePacket documentation.
Is the problem here that ARP isn't an "installed protocol", so outgoing ARP packets aren't sent by an installed protocol (and thus aren't forwarded to an NDIS binding with NDIS_PACKET_TYPE_ALL_LOCAL, at least according to the page in question) and incoming ARP packets aren't "forwarded to [an appropriate] bound protocol driver(s)"?
To support multicast or IPv6 (which requires support for multicast), then in
addition to these hardware filters, you also need to set:
NDIS_PACKET_TYPE_MULTICAST
Is that the same issue (e.g., multicast packets not send by, or not forwarded to, installed protocols not being seen)?
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
