出境运输级别的碎片 [英] Fragments on outbound transport level

问题描述

嗨！

我制作了一个WFP过滤器驱动程序，用于过滤OUTBOUND_TRANSPORT（和INBOUND_TRANSPORT）层上的所有流量。在某些流量情况下，我开始丢失数据包碎片。我在NBL-> Next和NB-> Next寻找fragmet-packages。似乎NB-> Next
有时包含信息，但我从这些NB获得DataLength和/或DataOffset的非法值。 

这是否适合查找片段？

此问题似乎与虚拟移动IP适配器有关，该适配器报告的MTU大小小于1500（即1300），以便为其MIP隧道腾出空间。

IP堆栈中实际处理的MTU大小是多少？

Best Regars Andy

解决方案

片段在INBOUND_IPPACKET和IPFORWARD层指示（加上从Win8开始  {IN | OUT} BOUND_MAC_FRAME_ETHERNET，{IN | OUT} BOUND_MAC_FRAME_NATIVE，  {IN | E} GRESS_VSWITCH_ETHERNET）。

当数据包进行传输时，片段已经被堆栈重新组装

希望这有帮助，

Hi!

I have made a WFP filterdriver that filters all traffic on OUTBOUND_TRANSPORT (and INBOUND_TRANSPORT) layers. In some traffic cases I start loosing fragments of packets. I look for fragmet-packages both at NBL->Next and NB->Next. It seems like NB->Next sometimes contains information, but I get illegal values for DataLength and/or DataOffset from these NBs. 

Is this the right place to look for fragments?

This problem seems to be connected with a virtual mobile IP adapter that reports a MTU size smaller than 1500 (ie 1300) to make space for its MIP tunnel.

How is actual the MTU size handled in the IP stack?

Best Regars Andy

解决方案

Fragments are indicated at INBOUND_IPPACKET and IPFORWARD layers (plus starting in Win8 {IN | OUT}BOUND_MAC_FRAME_ETHERNET, {IN | OUT}BOUND_MAC_FRAME_NATIVE,  {IN | E}GRESS_VSWITCH_ETHERNET).

By the time the packet has made it to transport, the fragments have been reassembled by the stack

Hope this helps,

这篇关于出境运输级别的碎片的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！