search

wiresock / ndisapi

Windows Packet Filter library for network packet interception and manipulation, suitable for custom firewall, VPN and traffic analysis applications.
https://www.ntkernel.com/windows-packet-filter/
MIT License
289 stars 78 forks source link

setting higher MTU fails to work when Windows Packet Filter installed #25

Closed ghost closed 6 months ago

ghost commented 6 months ago

Hi,

Wanting to use this as part of Proxifyre to force some stubborn non-proxy aware apps through a proxy connection.

However, when installed, interface MTU is limited to 1500 irrespective of any other interface configuration, and cannot be increased...

The system has two interfaces, one requiring jumbo frames at 9014 mtu, and a 'normal' interface with mtu 1500 through which the socks proxy is reachable (ie there is no route to the proxy via the interface with 9014 mtu).

When packet filter is installed, whilst the MTU size can be edited in the NIC settings, and even within the registry, netsh shows ONLY 1500, and it cannot in any way be increased. jumbo frames fail to be sent.

when uninstalled, netsh immediately shows the 'correct' mtu for the interface and jumbo frames 'work'

this tool does exactly what we need, but breaks other more critical things so knowing how to fix that would be amazing.

wiresock commented 6 months ago

In reviewing the common.h file, you might have noticed this definition:

#ifdef JUMBO_FRAME_SUPPORTED
#define MAX_ETHER_FRAME            9014 // Maximum size of the Ethernet frame when Jumbo Frames are supported
#else
#define MAX_ETHER_FRAME            1514 // Maximum size of the Ethernet frame when Jumbo Frames are not supported
#endif

This code segment indicates that to enable Jumbo Frame support in your network environment, both the Windows Packet Filter drivers and the NDISAPI need to be recompiled with the JUMBO_FRAME_SUPPORTED macro defined. It's crucial to be aware that in the default build of the Windows Packet Filter driver, Jumbo Frames are not enabled. This default configuration limits the Ethernet frame size to the standard maximum, rather than the larger size allowed by Jumbo Frames.

If you hold a license for the Windows Packet Filter driver, whether a Developer or Source Code license, I am available to assist you in compiling a suitable driver with Jumbo Frame support.

ghost commented 6 months ago

Cheers, should have read the NTKernel page where you specify this! I was coming from the Proxifyre github to here so didn't see any of the technical stuff :) License isn't useful to me as I was only looking at Proxifyre.

I'll close this as its not an 'issue' but more a documented 'limitation' that is of no consequence to 99% of people.