#include <Packet.h>
Data Fields | |
PDEVICE_EXTENSION | DeviceExtension |
Pointer to the _DEVICE_EXTENSION structure of the device on which the instance is bound. More... | |
NDIS_HANDLE | AdapterHandle |
NDIS idetifier of the adapter used by this instance. More... | |
UINT | Medium |
Type of physical medium the underlying NDIS driver uses. See the documentation of NdisOpenAdapter in the MS DDK for details. More... | |
NDIS_HANDLE | PacketPool |
Pool of NDIS_PACKET structures used to transfer the packets from and to the NIC driver. More... | |
PIRP | OpenCloseIrp |
Pointer used to store the open/close IRP requests and provide them to the callbacks of NDIS. More... | |
KSPIN_LOCK | RequestSpinLock |
SpinLock used to synchronize the OID requests. More... | |
LIST_ENTRY | RequestList |
List of pending OID requests. More... | |
LIST_ENTRY | ResetIrpList |
List of pending adapter reset requests. More... | |
INTERNAL_REQUEST | Requests [MAX_REQUESTS] |
Array of structures that wrap every single OID request. More... | |
PMDL | BufferMdl |
Pointer to a Memory descriptor list (MDL) that maps the circular buffer's memory. More... | |
PKEVENT | ReadEvent |
Pointer to the event on which the read calls on this instance must wait. More... | |
HANDLE | ReadEventHandle |
Handle of the event on which the read calls on this instance must wait. More... | |
UNICODE_STRING | ReadEventName |
Name of the event on which the read calls on this instance must wait. The event is created with a name, so it can be used at user level to know when it is possible to access the driver without being blocked. This fiels stores the name that and is used by the BIOCGEVNAME IOCTL call. More... | |
INT | Received |
Number of packets received by current instance from its opening, i.e. number of packet received by the network adapter since the beginning of the capture/monitoring/dump session. More... | |
INT | Dropped |
Number of packet that current instance had to drop, from its opening. A packet is dropped if there is no more space to store it in the circular buffer that the driver associates to current instance. More... | |
INT | Accepted |
Number of packet that current capture instance acepted, from its opening. A packet is accepted if it passes the filter and fits in the buffer. Accepted packets are the ones that reach the application. More... | |
PUCHAR | bpfprogram |
Pointer to the filtering pseudo-code associated with current instance of the driver. This code is used only in particular situations (for example when the packet received from the NIC driver is stored in two non-consecutive buffers. In normal situations the filtering routine created by the JIT compiler and pointed by the next field is used. See NPF driver internals manual for details on the filtering process. More... | |
JIT_BPF_Filter * | Filter |
Pointer to the native filtering function created by the jitter. See BPF_jitter() for details. More... | |
PUCHAR | Buffer |
Pointer to the circular buffer associated with every driver instance. It contains the data that will be passed to the application. See NPF driver internals manual for details. More... | |
UINT | Bhead |
Head of the circular buffer. More... | |
UINT | Btail |
Tail of the circular buffer. More... | |
UINT | BufSize |
Size of the circular buffer. More... | |
UINT | BLastByte |
Position of the last valid byte in the circular buffer. More... | |
PMDL | TransferMdl |
MDL used to map the portion of the buffer that will contain an incoming packet. Used by NdisTransferData(). More... | |
NDIS_SPIN_LOCK | BufLock |
SpinLock that protects the access tho the circular buffer variables. More... | |
UINT | MinToCopy |
Minimum amount of data in the circular buffer that unlocks a read. Set with the BIOCSMINTOCOPY IOCTL. More... | |
LARGE_INTEGER | TimeOut |
Timeout after which a read is released, also if the amount of data in the buffer is less than MinToCopy. Set with the BIOCSRTIMEOUT IOCTL. More... | |
int | mode |
Working mode of the driver. See PacketSetMode() for details. More... | |
LARGE_INTEGER | Nbytes |
Amount of bytes accepted by the filter when this instance is in statistical mode. More... | |
LARGE_INTEGER | Npackets |
Number of packets accepted by the filter when this instance is in statistical mode. More... | |
NDIS_SPIN_LOCK | CountersLock |
SpinLock that protects the statistical mode counters. More... | |
UINT | Nwrites |
Number of times a single write must be physically repeated. See NPF driver internals manual for an explanation. More... | |
UINT | Multiple_Write_Counter |
Counts the number of times a single write has already physically repeated. More... | |
NDIS_EVENT | WriteEvent |
Event used to synchronize the multiple write process. More... | |
NDIS_EVENT | IOEvent |
Event used to synchronize I/O requests with the callback structure of NDIS. More... | |
NDIS_STATUS | IOStatus |
Maintains the status of and OID request call, that will be passed to the application. More... | |
BOOLEAN | Bound |
Specifies if NPF is still bound to the adapter used by this instance. Bound can be FALSE if a Plug and Play adapter has been removed or disabled by the user. More... | |
HANDLE | DumpFileHandle |
Handle of the file used in dump mode. More... | |
PFILE_OBJECT | DumpFileObject |
Pointer to the object of the file used in dump mode. More... | |
PKTHREAD | DumpThreadObject |
Pointer to the object of the thread used in dump mode. More... | |
HANDLE | DumpThreadHandle |
Handle of the thread created by dump mode to asynchronously move the buffer to disk. More... | |
NDIS_EVENT | DumpEvent |
Event used to synchronize the dump thread with the tap when the instance is in dump mode. More... | |
LARGE_INTEGER | DumpOffset |
Current offset in the dump file. More... | |
UNICODE_STRING | DumpFileName |
String containing the name of the dump file. More... | |
UINT | MaxDumpBytes |
Maximum dimension in bytes of the dump file. If the dump file reaches this size it will be closed. A value of 0 means unlimited size. More... | |
UINT | MaxDumpPacks |
Maximum number of packets that will be saved in the dump file. If this number of packets is reached the dump will be closed. A value of 0 means unlimited number of packets. More... | |
BOOLEAN | DumpLimitReached |
TRUE if the maximum dimension of the dump file (MaxDumpBytes or MaxDumpPacks) is reached. More... | |
MEM_TYPE | mem_ex |
Memory used by the TME virtual co-processor. More... | |
TME_CORE | tme |
Data structure containing the virtualization of the TME co-processor. More... | |
NDIS_SPIN_LOCK | machine_lock |
SpinLock that protects the mem_ex buffer. More... |
This is the most important structure of NPF: it is used by almost all the functions of the driver. An _OPEN_INSTANCE structure is associated with every user-level session, allowing concurrent access to the driver.
Definition at line 273 of file Packet.h.
|
Number of packet that current capture instance acepted, from its opening. A packet is accepted if it passes the filter and fits in the buffer. Accepted packets are the ones that reach the application.
Definition at line 300 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, and NPF_tap. |
|
NDIS idetifier of the adapter used by this instance.
Definition at line 277 of file Packet.h. Referenced by NPF_BufferedWrite, NPF_Close, NPF_IoControl, NPF_Open, NPF_tap, NPF_UnbindAdapter, and NPF_Write. |
|
Head of the circular buffer.
Definition at line 312 of file Packet.h. Referenced by GetBuffOccupation, NPF_IoControl, NPF_Open, NPF_Read, and NPF_SaveCurrentBuffer. |
|
Position of the last valid byte in the circular buffer.
Definition at line 315 of file Packet.h. Referenced by GetBuffOccupation, NPF_IoControl, NPF_Open, NPF_Read, NPF_SaveCurrentBuffer, and NPF_tap. |
|
Specifies if NPF is still bound to the adapter used by this instance. Bound can be FALSE if a Plug and Play adapter has been removed or disabled by the user.
Definition at line 334 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_Open, NPF_Read, and NPF_UnbindAdapter. |
|
Pointer to the filtering pseudo-code associated with current instance of the driver. This code is used only in particular situations (for example when the packet received from the NIC driver is stored in two non-consecutive buffers. In normal situations the filtering routine created by the JIT compiler and pointed by the next field is used. See NPF driver internals manual for details on the filtering process.
Definition at line 303 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_IoControl, NPF_Open, and NPF_tap. |
|
Tail of the circular buffer.
Definition at line 313 of file Packet.h. Referenced by GetBuffOccupation, NPF_IoControl, NPF_Open, NPF_Read, NPF_SaveCurrentBuffer, and NPF_tap. |
|
Pointer to the circular buffer associated with every driver instance. It contains the data that will be passed to the application. See NPF driver internals manual for details.
Definition at line 310 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_IoControl, NPF_Open, NPF_Read, NPF_SaveCurrentBuffer, and NPF_tap. |
|
Pointer to a Memory descriptor list (MDL) that maps the circular buffer's memory.
|
|
SpinLock that protects the access tho the circular buffer variables.
Definition at line 318 of file Packet.h. Referenced by GetBuffOccupation, NPF_Open, NPF_Read, and NPF_tap. |
|
Size of the circular buffer.
Definition at line 314 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_DumpThread, NPF_IoControl, NPF_Open, NPF_tap, and NPF_UnbindAdapter. |
|
SpinLock that protects the statistical mode counters.
|
|
Pointer to the _DEVICE_EXTENSION structure of the device on which the instance is bound.
Definition at line 275 of file Packet.h. Referenced by NPF_Open. |
|
Number of packet that current instance had to drop, from its opening. A packet is dropped if there is no more space to store it in the circular buffer that the driver associates to current instance.
Definition at line 297 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, and NPF_tap. |
|
Event used to synchronize the dump thread with the tap when the instance is in dump mode.
Definition at line 340 of file Packet.h. Referenced by NPF_Close, NPF_DumpThread, NPF_Open, NPF_tap, NPF_TransferDataComplete, and NPF_UnbindAdapter. |
|
Handle of the file used in dump mode.
Definition at line 336 of file Packet.h. Referenced by NPF_Close, NPF_CloseDumpFile, NPF_IoControl, NPF_Open, NPF_OpenDumpFile, NPF_Read, NPF_StartDump, and NPF_UnbindAdapter. |
|
String containing the name of the dump file.
Definition at line 342 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_CloseDumpFile, NPF_IoControl, and NPF_Open. |
|
Pointer to the object of the file used in dump mode.
Definition at line 337 of file Packet.h. Referenced by NPF_CloseDumpFile, NPF_OpenDumpFile, NPF_SaveCurrentBuffer, and NPF_StartDump. |
|
TRUE if the maximum dimension of the dump file (MaxDumpBytes or MaxDumpPacks) is reached.
Definition at line 348 of file Packet.h. Referenced by NPF_DumpThread, NPF_IoControl, NPF_Open, NPF_SaveCurrentBuffer, and NPF_tap. |
|
Current offset in the dump file.
Definition at line 341 of file Packet.h. Referenced by NPF_CloseDumpFile, NPF_DumpThread, NPF_Read, NPF_SaveCurrentBuffer, and NPF_StartDump. |
|
Handle of the thread created by dump mode to asynchronously move the buffer to disk.
Definition at line 339 of file Packet.h. Referenced by NPF_StartDump. |
|
Pointer to the object of the thread used in dump mode.
Definition at line 338 of file Packet.h. Referenced by NPF_Close, and NPF_StartDump. |
|
Pointer to the native filtering function created by the jitter. See BPF_jitter() for details.
Definition at line 308 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_IoControl, and NPF_tap. |
|
Event used to synchronize I/O requests with the callback structure of NDIS.
Definition at line 332 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_IoControl, NPF_Open, NPF_RequestComplete, and NPF_UnbindAdapter. |
|
Maintains the status of and OID request call, that will be passed to the application.
Definition at line 333 of file Packet.h. Referenced by NPF_IoControl, and NPF_RequestComplete. |
|
SpinLock that protects the mem_ex buffer.
|
|
Maximum dimension in bytes of the dump file. If the dump file reaches this size it will be closed. A value of 0 means unlimited size.
Definition at line 343 of file Packet.h. Referenced by NPF_IoControl, and NPF_SaveCurrentBuffer. |
|
Maximum number of packets that will be saved in the dump file. If this number of packets is reached the dump will be closed. A value of 0 means unlimited number of packets.
Definition at line 345 of file Packet.h. Referenced by NPF_IoControl, and NPF_tap. |
|
Type of physical medium the underlying NDIS driver uses. See the documentation of NdisOpenAdapter in the MS DDK for details.
Definition at line 278 of file Packet.h. Referenced by NPF_Open, and NPF_StartDump. |
|
Memory used by the TME virtual co-processor.
Definition at line 350 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_IoControl, NPF_Open, NPF_OpenAdapterComplete, and NPF_tap. |
|
Minimum amount of data in the circular buffer that unlocks a read. Set with the BIOCSMINTOCOPY IOCTL.
Definition at line 319 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, NPF_Read, NPF_tap, and NPF_TransferDataComplete. |
|
Working mode of the driver. See PacketSetMode() for details.
Definition at line 324 of file Packet.h. Referenced by NPF_Close, NPF_IoControl, NPF_Open, NPF_Read, NPF_tap, NPF_TransferDataComplete, and NPF_UnbindAdapter. |
|
Counts the number of times a single write has already physically repeated.
Definition at line 330 of file Packet.h. Referenced by NPF_Open, NPF_SendComplete, and NPF_Write. |
|
Amount of bytes accepted by the filter when this instance is in statistical mode.
Definition at line 325 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, NPF_Read, and NPF_tap. |
|
Number of packets accepted by the filter when this instance is in statistical mode.
Definition at line 326 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, NPF_Read, and NPF_tap. |
|
Number of times a single write must be physically repeated. See NPF driver internals manual for an explanation.
Definition at line 328 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, NPF_SendComplete, and NPF_Write. |
|
Pointer used to store the open/close IRP requests and provide them to the callbacks of NDIS.
Definition at line 281 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_Open, and NPF_OpenAdapterComplete. |
|
Pool of NDIS_PACKET structures used to transfer the packets from and to the NIC driver.
Definition at line 280 of file Packet.h. Referenced by NPF_BufferedWrite, NPF_Close, NPF_CloseAdapterComplete, NPF_Open, NPF_OpenAdapterComplete, NPF_tap, and NPF_Write. |
|
Pointer to the event on which the read calls on this instance must wait.
Definition at line 288 of file Packet.h. Referenced by NPF_Close, NPF_Open, NPF_Read, NPF_SaveCurrentBuffer, NPF_tap, NPF_TransferDataComplete, and NPF_UnbindAdapter. |
|
Handle of the event on which the read calls on this instance must wait.
Definition at line 289 of file Packet.h. Referenced by NPF_Close, NPF_Open, and NPF_UnbindAdapter. |
|
Name of the event on which the read calls on this instance must wait. The event is created with a name, so it can be used at user level to know when it is possible to access the driver without being blocked. This fiels stores the name that and is used by the BIOCGEVNAME IOCTL call.
Definition at line 290 of file Packet.h. Referenced by NPF_Close, NPF_CloseAdapterComplete, NPF_IoControl, NPF_Open, and NPF_OpenAdapterComplete. |
|
Number of packets received by current instance from its opening, i.e. number of packet received by the network adapter since the beginning of the capture/monitoring/dump session.
Definition at line 294 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, and NPF_tap. |
|
List of pending OID requests.
Definition at line 284 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, and NPF_RequestComplete. |
|
Array of structures that wrap every single OID request.
Definition at line 286 of file Packet.h. Referenced by NPF_Open. |
|
SpinLock used to synchronize the OID requests.
Definition at line 283 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, NPF_RequestComplete, and NPF_ResetComplete. |
|
List of pending adapter reset requests.
Definition at line 285 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, and NPF_ResetComplete. |
|
Timeout after which a read is released, also if the amount of data in the buffer is less than MinToCopy. Set with the BIOCSRTIMEOUT IOCTL.
Definition at line 321 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, and NPF_Read. |
|
Data structure containing the virtualization of the TME co-processor.
Definition at line 351 of file Packet.h. Referenced by NPF_IoControl, NPF_Open, NPF_Read, and NPF_tap. |
|
MDL used to map the portion of the buffer that will contain an incoming packet. Used by NdisTransferData().
Definition at line 316 of file Packet.h. Referenced by NPF_tap, and NPF_TransferDataComplete. |
|
Event used to synchronize the multiple write process.
Definition at line 331 of file Packet.h. Referenced by NPF_Open, NPF_SendComplete, and NPF_Write. |
documentation. Copyright (c) 2002 Politecnico di Torino. All rights reserved.