how to acces whole packet on (IN/OUT) TRANSPORT LAYER

Hi, i ha ve a following problem .. I registered callout on in, out transport
layer and i want to get the whole packet data from ETHERNET HEADER (mean from
dest. mac, source mac, protocol ) ending with the data data ...

i have tried this :

NdisRetreatNetBufferDataStart(
NET_BUFFER_LIST_FIRST_NB(pendedPacket->netBufferList),
pendedPacket->ipHeaderSize + pendedPacket->transportHeaderSize, 0,
NULL);

pendedPacket->netBufferListSize =
NET_BUFFER_DATA_LENGTH(NET_BUFFER_LIST_FIRST_NB(pe ndedPacket->netBufferList));

netBuffer = NET_BUFFER_LIST_FIRST_NB(pendedPacket->netBufferList);
pendedPacket->netBufferDataLength =NET_BUFFER_DATA_LENGTH(netBuffer);
currentMdl =NET_BUFFER_CURRENT_MDL(netBuffer);

packet = (UCHAR*) MmGetSystemAddressForMdlSafe(currentMdl, HighPagePriority
);

pendedPacket->packetDataLength = MmGetMdlByteCount(currentMdl);

-----
in packet, there should be the whole packet from begginig of the Eth.
Header, but there is not. What im doing wrong ? Where does
MmGetSystemAddressForMdlSafe point ?

thx for answers ..

Hi, thx for answer, but didnt helped ... Im currently using WFP to get data
packet data in TRANSPORT CALLOUT (IN/OUT direction).

if i do what you wrote, it will give me the same portion of data .. i
checked in windbg. Something is there not good :/

"eagersh" wrote:

> On Oct 31, 1:09 pm, nakato <nak...@discussions.microsoft.com> wrote:
> > Hi, i ha ve a following problem .. I registered callout on in, out transport
> > layer and i want to get the whole packet data from ETHERNET HEADER (mean from
> > dest. mac, source mac, protocol ) ending with the data data ...
> >
> > i have tried this :
> >
> > NdisRetreatNetBufferDataStart(
> > NET_BUFFER_LIST_FIRST_NB(pendedPacket->netBufferList),
> > pendedPacket->ipHeaderSize + pendedPacket->transportHeaderSize, 0,
> > NULL);
> >
> > pendedPacket->netBufferListSize =
> > NET_BUFFER_DATA_LENGTH(NET_BUFFER_LIST_FIRST_NB(pe ndedPacket->netBufferList));
> >
> > netBuffer = NET_BUFFER_LIST_FIRST_NB(pendedPacket->netBufferList);
> > pendedPacket->netBufferDataLength =NET_BUFFER_DATA_LENGTH(netBuffer);
> > currentMdl =NET_BUFFER_CURRENT_MDL(netBuffer);
> >
> > packet = (UCHAR*) MmGetSystemAddressForMdlSafe(currentMdl, HighPagePriority
> > );
> >
> > pendedPacket->packetDataLength = MmGetMdlByteCount(currentMdl);
> >
> > -----
> > in packet, there should be the whole packet from begginig of the Eth.
> > Header, but there is not. What im doing wrong ? Where does
> > MmGetSystemAddressForMdlSafe point ?
> >
> > thx for answers ..
>
> Because you move the current pointer in NET_BUFFER by
> NdisRetreatNetBufferDataStart you could not get Ethernet header.
> Before calling NdisRetreatNetBufferDataStart you should call
> packet = MmGetSystemAddressForMdlSafe(NET_BUFFER_CURRENT_MD L()) +
> NET_BUFFER_CURRENT_MDL_OFFSET());
>
> Igor Sharovar
>
> .
>