NDIS study Note 1

 

Due to communication problems in the project, prepare a tool that can simulate packet loss for troubleshooting and make up for the network knowledge. At the beginning, I thought that the SPI technology could be used to solve the problem. Later I realized that packet loss and so on must be completed under the protocol layer. For the protocol layer, I wanted to publish a complete article after it was done.ArticleThe result shows that the difficulty is a little higher than expected. There is no way to make it too bad.

 

Introduction to intermediate layer driver Technology

The middle-layer driver. The English version is NDIS intermediate driver.

1) kernel-level network driver Introduction
Microsoft
Windows NT supports three basic kernel-level network drivers:
1.
Miniport Nic drivers: the driver of the micro-port Nic, which is located at the bottom layer. It directly operates the NIC and provides interfaces for the high-level driver.
2.
Intermediate Drivers: the IMD middle layer driver, which is the main character of today. It is located between 1 and 3. The specific functions are described below.
3.
Protocol drivers: High-level protocol driver, commonly known as TDIProgramInterface), which is higher than the first two layers and is directly oriented to the user level, providing network services for users, that is, the network interfaces used by most programs.

 

2) IMD driver
The IMD middle layer is actually very simple. The most classic description is the following:

An intermediate driver is
Typically layered over one or more NDIS Nic drivers and under a transport
Driver (possibly multilayered) that supports TDI at its upper edge.
An NDIS Intermediate
Driver exports miniportxxx functions at its upper edge and protocolxxx
Functions at its lower edge. (See DDK Documentation)

The middle layer is inserted between the nic and the protocol layer. The above protocol layer is represented by a virtual microport Nic structure, while the following Nic is represented by a protocol layer structure. Therefore, whether it is the datagram received and uploaded by the network adapter or the datagram sent to the network adapter at the upper layer, it must go through the middle layer without exception.

3) IMD packet filtering technology
As we have seen above, all the data packets must pass through the middle layer. Therefore, we can add the features of the data packets we want to filter in the middle layer to implement kernel-level packet filtering based on the middle layer driver.