PACKET HEADER [英] PACKET HEADER
问题描述
HI每一个：
我想问为什么我需要使用函数NdisRetreatNetBufferDataStart（）（我知道它用于增加使用区域），但我做了不明白为什么我需要增加使用面积
I want to ask why i needed to used the function NdisRetreatNetBufferDataStart()(I know its uses to increases the used area),but i did not understand why i need to increase used area
第二个问题：我怎么能得到包的到达时间因为我这次需要在我的程序中
second question: How i can got the time of arrived of packet because i needed this time in my program
推荐答案
它本质上是一个用于执行指针算法的包装器（具有额外的功能）。当数据包遍历堆栈时，数据偏移会因标题的剥离而发生变化。 这意味着在不同的层，数据偏移指向数据包中不同的
位置。 为了查看以前的位置，此功能简化了将指针向后移动的过程。
It's essentially a wrapper for doing pointer arithmetic (with extra functionality). As the packet traverses the stack, the data offset changes due to stripping of the headers. This means that at different layers, the data offset points to different locations in the packet. in order to see the previous locations, this function simplifies walking the pointer back.
请参阅WFPSampler了解其使用方法：
http://code.msdn.microsoft.com/windowshardware/Windows-Filtering-Platform-27553baa/sourcecode?fileId=51338&pathId=1593545230
See the WFPSampler for how it is being used:
http://code.msdn.microsoft.com/windowshardware/Windows-Filtering-Platform-27553baa/sourcecode?fileId=51338&pathId=1593545230
以及各个层的NBL数据偏移量：
http://msdn.microsoft.com/en-us/library/windows/hardware/ff546324（v = vs.85）的.aspx
and the NBL's data offsets for the various layers:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff546324(v=vs.85).aspx
至于收到的时间，你需要实施一个标注并自己抽出时间。 你会坐在FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET（Win8 +，如果你对NDIS第一次看到数据包时很挑剔）或者FWPM_LAYER_INBOUND_IPPACKET_V {4
| 6}（Vista +，如果您只关心TCP / IP堆栈何时首次看到它）。
As for the time received, you would need to implement a callout and get the time yourself. You would sit at FWPM_LAYER_INBOUND_MAC_FRAME_ETHERNET (Win8+ and if you are picky about when NDIS first sees the packet) or FWPM_LAYER_INBOUND_IPPACKET_V{4 | 6} (Vista+ and if you only care about when the TCP/IP stack first sees it).
希望这有帮助，
这篇关于PACKET HEADER的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
