search

wiresock / ndisapi

Windows Packet Filter library for network packet interception and manipulation, suitable for custom firewall, VPN and traffic analysis applications.
https://www.ntkernel.com/windows-packet-filter/
MIT License
289 stars 78 forks source link

In case of GRE encapsulation, Fragmentation required due to exceeding 1514 Bytes #13

Closed dattran96 closed 2 years ago

dattran96 commented 2 years ago

Hi Smirnov,

I noticed that the MAX_ETHER_FRAMEis hardcoded with size of 1514. In other words, the array m_IBufferof struct INTERMEDIATE_BUFFER is limited to 1514 bytes.

In my case, I added 24-bytes header for GRE encapsulation. Therefore, the total size is increased to 1538 bytes (1514+24). In this case, fragmentation must be done.

My question is, does winpkfilter driver already support fragmentation? In other words, just by replacing the constant MAX_ETHER_FRAME to 1538 will solve my problem?

Best Regards, Dat

wiresock commented 2 years ago

Hi Dat,

No, the driver won't do packet fragmentation for you. If, after attaching extra headers, your packet size exceeds MTU (typically Internet MTU never exceeds 1514 bytes, in LAN jumbo frames can reach 9014 bytes size), then you have to fragment it into two INTERMEDIATE_BUFFER structures and inject two packets instead of one. However, I would recommend avoiding fragmentation (fragmented packets are often silently dropped by firewalls/routers) at all. For example, for TCP protocol, you could manipulate the TCP MSS option to limit the maximum packet size and thus reserve space for your extra headers.

Hope it helps. Vadim