Questoin to the nowere.. Project is dead. Pay your attention at <a href="http://www.rawether.net/">http://www.rawether.net/</a> Bye.<br><br><div class="gmail_quote">2013/1/18 Patrick Malka <span dir="ltr"><<a href="mailto:malka.patrick@gmail.com" target="_blank">malka.patrick@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><b style="color:rgb(34,34,34);font-size:medium;font-family:'Times New Roman';font-weight:normal"><span style="font-size:15px;font-family:Arial;vertical-align:baseline;white-space:pre-wrap">Hello, I have some generic IP related questions that I thought some of the people on this list might be able to answer since this product is very similar in functionality to what we are doing.</span></b></div>
<b style="color:rgb(34,34,34);font-weight:normal"><span style="font-family:Arial;font-size:15px;vertical-align:baseline;white-space:pre-wrap"><div><b style="color:rgb(34,34,34);font-size:medium;font-family:'Times New Roman';font-weight:normal"><span style="font-size:15px;font-family:Arial;vertical-align:baseline;white-space:pre-wrap"><br>
</span></b></div>In Windows, we are using the fwps* family of driver functions to filter IP packets. The filter mechanism is not important, but rather what happens during the callback functions for packets that match the filter.</span><br>
<span style="font-size:15px;font-family:Arial;vertical-align:baseline;white-space:pre-wrap"></span><br><span style="font-family:Arial;font-size:15px;vertical-align:baseline;white-space:pre-wrap">In these callbacks, we wish to alter the data, and have the reverse operation performed on the receiving end. Our goal is to perform encryption and tamper detection.</span><br>
<span style="font-size:15px;font-family:Arial;vertical-align:baseline;white-space:pre-wrap"></span><br><span style="font-family:Arial;font-size:15px;vertical-align:baseline;white-space:pre-wrap">Encryption is fairly easy to do as it does not alter the size of the (IP) packet, but tamper detection is proving to be harder due to the need to send extra data in addition to the payload in order to be able to detect tampering.</span><br>
<span style="font-size:15px;font-family:Arial;vertical-align:baseline;white-space:pre-wrap"></span><br><span style="font-family:Arial;font-size:15px;vertical-align:baseline;white-space:pre-wrap">In this light, my questions are:</span><br>
<ul style="font-family:'Times New Roman';font-size:medium;margin-top:0pt;margin-bottom:0pt"><li dir="ltr" style="margin-left:15px;list-style-type:disc;font-size:15px;font-family:Arial;vertical-align:baseline"><span style="vertical-align:baseline;white-space:pre-wrap">If I reinject (FwpsInjectNetwork*Async0) an IP packet that is larger than the ethernet MTU, what will happen? Will it be rejected or fragmented? Does the answer depend on the specific environment?</span></li>
<li dir="ltr" style="margin-left:15px;list-style-type:disc;font-size:15px;font-family:Arial;vertical-align:baseline"><span style="vertical-align:baseline;white-space:pre-wrap">If I fragment an IP packet explicitly before reinjecting it, will the fragments then be filtered again?</span></li>
<li dir="ltr" style="margin-left:15px;list-style-type:disc;font-size:15px;font-family:Arial;vertical-align:baseline"><span style="vertical-align:baseline;white-space:pre-wrap">If I want to send a packet larger than the ethernet MTU, must I fragment it myself or will Windows do it for me after reinjection.</span></li>
<li dir="ltr" style="margin-left:15px;list-style-type:disc;font-size:15px;font-family:Arial;vertical-align:baseline"><span style="vertical-align:baseline;white-space:pre-wrap">If I fragment an IP packet during a send, will my receiving IP filter see the fragment packets or the assembled packet? Where does reassembly occur, before or after the various Windows driver filters.</span></li>
<li dir="ltr" style="margin-left:15px;list-style-type:disc;font-size:15px;font-family:Arial;vertical-align:baseline"><span style="vertical-align:baseline;white-space:pre-wrap">Is there a way to safely process a maximum size IP packet (one that will just fit into an ethernet frame) such that tamper detection can be performed on the receiving end without having to expand and fragment the packet?</span></li>
<li dir="ltr" style="margin-left:15px;list-style-type:disc;font-size:15px;font-family:Arial;vertical-align:baseline"><span style="vertical-align:baseline;white-space:pre-wrap">If I take an IP packet and add an IP option to the header, does that count as increasing the packet size? (I think the answer is yes, I just thought I would get confirmation).</span></li>
</ul><div><font face="Arial"><span style="font-size:15px;white-space:pre-wrap"><br></span></font></div><div><font face="Arial"><span style="font-size:15px;white-space:pre-wrap">Thanks for any help anyone can provide.</span></font></div>
</b>
<br>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
<br></blockquote></div><br>