Как вводить пакеты в путь получения (Rx) с помощью драйвера LWF в Windows?

Я разрабатываю драйвер облегченного фильтра NDIS 6 (LWF) на основе WinPcap. Мы можем представить, что есть два пути для сетевого адаптера: Tx и Rx.

Tx - способ отправки.

Rx - приемный путь.

Мы знаем, что WinPcap может отправлять пакеты в сеть (так что это Tx способ). Я хочу знать, возможно ли отправлять пакеты на Rx, поэтому это означает введение пакета в адаптер и представление этого пакета как пакета, пришедшего из сети.

Во-первых, я не знаю, если это жизнеспособно? Если да, то продолжайте читать:

Я написал код, используя вызов NdisFIndicateReceiveNetBufferLists, чтобы указать мой созданный пакет на верхний уровень, а затем освободить пакет в обработчике FilterReturnNetBufferLists. Таким образом, модули верхнего уровня, включая ОС Windows, будут знать, что из сети пришел новый пакет (на самом деле это неправда).

Однако мой подход не работает. Я использовал Nping (из Nmap) для проверки связи со своим шлюзом, и окно nping зависает, его не может закрыть даже диспетчер задач. Так что это должна быть остановка водителя.

Я заметил, что этот способ должен быть возможен на основе:

1. Ответ Джеффри на сообщение: Is FilterSendNetBufferLists обработчик необходим для фильтра NDIS для использования NdisFSendNetBufferLists?

2. Пояснение от Microsoft: https://msdn.microsoft.com/en-us/library/windows/hardware/ff570452(v=vs.85).aspx

3. Пример предоставлен OSR: https://www.osronline.com/showthread.cfm?link=242847

Затем я проанализировал журнал, напечатанный драйвером. Похоже мой NdisFIndicateReceiveNetBufferLists звонок (использовался для отправки на Rx) звонили только один раз, потом драйвер работает на других работах, а кольцо 3 nping умерло. Я повторно использовал большую часть кода из существующего хорошо работающего кода из NPF_SendCompleteEx (это обработчик отправки завершения в обычный Tx). Так я не думаю, что эта часть будет иметь ошибки?

Весь код размещен на GitHub: https://github.com/nmap/npcap.

он не содержит ошибочного кода в этом посте, так как я его не отправлял, но он предоставит некоторые фоны, если вам нужно:)

Мой инъекционный код:

NTSTATUS
NPF_Write(
    IN PDEVICE_OBJECT DeviceObject,
    IN PIRP Irp
    )
{
    POPEN_INSTANCE      Open;
    POPEN_INSTANCE      GroupOpen;
    POPEN_INSTANCE      TempOpen;
    PIO_STACK_LOCATION  IrpSp;
    ULONG               SendFlags = 0;
    PNET_BUFFER_LIST    pNetBufferList;
    NDIS_STATUS         Status;
    ULONG               NumSends;
    ULONG               numSentPackets;

    TRACE_ENTER();

    IrpSp = IoGetCurrentIrpStackLocation(Irp);

    Open = IrpSp->FileObject->FsContext;

    if (NPF_StartUsingOpenInstance(Open) == FALSE)
    {
        // 
        // an IRP_MJ_CLEANUP was received, just fail the request
        //
        Irp->IoStatus.Information = 0;
        Irp->IoStatus.Status = STATUS_CANCELLED;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);
        TRACE_EXIT();
        return STATUS_CANCELLED;
    }

    NumSends = Open->Nwrites;

    //
    // validate the send parameters set by the IOCTL
    //
    if (NumSends == 0)
    {
        NPF_StopUsingOpenInstance(Open);
        Irp->IoStatus.Information = 0;
        Irp->IoStatus.Status = STATUS_SUCCESS;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);

        TRACE_EXIT();
        return STATUS_SUCCESS;
    }

    //
    // Validate input parameters: 
    // 1. The packet size should be greater than 0,
    // 2. less-equal than max frame size for the link layer and
    // 3. the maximum frame size of the link layer should not be zero.
    //
    if (IrpSp->Parameters.Write.Length == 0 ||  // Check that the buffer provided by the user is not empty
        Open->MaxFrameSize == 0 ||  // Check that the MaxFrameSize is correctly initialized
        Irp->MdlAddress == NULL ||
        IrpSp->Parameters.Write.Length > Open->MaxFrameSize) // Check that the fame size is smaller that the MTU
    {
        TRACE_MESSAGE(PACKET_DEBUG_LOUD, "Frame size out of range, or maxFrameSize = 0. Send aborted");

        NPF_StopUsingOpenInstance(Open);

        Irp->IoStatus.Information = 0;
        Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);

        TRACE_EXIT();
        return STATUS_UNSUCCESSFUL;
    }

    // 
    // Increment the ref counter of the binding handle, if possible
    //
    if (NPF_StartUsingBinding(Open) == FALSE)
    {
        TRACE_MESSAGE(PACKET_DEBUG_LOUD, "Adapter is probably unbinding, cannot send packets");

        NPF_StopUsingOpenInstance(Open);

        Irp->IoStatus.Information = 0;
        Irp->IoStatus.Status = STATUS_INVALID_DEVICE_REQUEST;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);

        TRACE_EXIT();
        return STATUS_INVALID_DEVICE_REQUEST;
    } 

    NdisAcquireSpinLock(&Open->WriteLock);
    if (Open->WriteInProgress)
    {
        // Another write operation is currently in progress
        NdisReleaseSpinLock(&Open->WriteLock);

        NPF_StopUsingBinding(Open);

        TRACE_MESSAGE(PACKET_DEBUG_LOUD, "Another Send operation is in progress, aborting.");

        NPF_StopUsingOpenInstance(Open);

        Irp->IoStatus.Information = 0;
        Irp->IoStatus.Status = STATUS_UNSUCCESSFUL;
        IoCompleteRequest(Irp, IO_NO_INCREMENT);

        TRACE_EXIT();

        return STATUS_UNSUCCESSFUL;
    }
    else
    {
        Open->WriteInProgress = TRUE;
        NdisResetEvent(&Open->NdisWriteCompleteEvent);
    }

    NdisReleaseSpinLock(&Open->WriteLock);

    TRACE_MESSAGE2(PACKET_DEBUG_LOUD,
        "Max frame size = %u, packet size = %u",
        Open->MaxFrameSize,
        IrpSp->Parameters.Write.Length);

    //
    // reset the number of packets pending the SendComplete
    //
    Open->TransmitPendingPackets = 0;

    NdisResetEvent(&Open->WriteEvent);

    numSentPackets = 0;

    while (numSentPackets < NumSends)
    {
        pNetBufferList = NdisAllocateNetBufferAndNetBufferList(Open->PacketPool,
            0,
            0,
            Irp->MdlAddress,
            0,
            Irp->MdlAddress->ByteCount);

        if (pNetBufferList != NULL)
        {
            //
            // packet is available, prepare it and send it with NdisSend.
            //

            //
            // If asked, set the flags for this packet.
            // Currently, the only situation in which we set the flags is to disable the reception of loopback
            // packets, i.e. of the packets sent by us.
            //
            //if (Open->SkipSentPackets)
            //{
            //  NPFSetNBLFlags(pNetBufferList, g_SendPacketFlags);
            //}


            // The packet hasn't a buffer that needs not to be freed after every single write
            RESERVED(pNetBufferList)->FreeBufAfterWrite = FALSE;

            // Save the IRP associated with the packet
            // RESERVED(pPacket)->Irp=Irp;

            // Attach the writes buffer to the packet

            InterlockedIncrement(&Open->TransmitPendingPackets);

            NdisResetEvent(&Open->NdisWriteCompleteEvent);

            //receive the packets before sending them
            ASSERT(Open->GroupHead != NULL);
            if (Open->GroupHead != NULL)
            {
                GroupOpen = Open->GroupHead->GroupNext;
            }
            else
            {
                //this is impossible
                GroupOpen = Open->GroupNext;
            }

#ifdef HAVE_WFP_LOOPBACK_SUPPORT
            // Do not capture the send traffic we send, if this is our loopback adapter.
            if (Open->Loopback == FALSE)
            {
#endif
                while (GroupOpen != NULL)
                {
                    TempOpen = GroupOpen;
                    if (TempOpen->AdapterBindingStatus == ADAPTER_BOUND && TempOpen->SkipSentPackets == FALSE)
                    {
                        NPF_TapExForEachOpen(TempOpen, pNetBufferList);
                    }

                    GroupOpen = TempOpen->GroupNext;
                }
#ifdef HAVE_WFP_LOOPBACK_SUPPORT
            }
#endif

            pNetBufferList->SourceHandle = Open->AdapterHandle;
            NPFSetNBLChildOpen(pNetBufferList, Open); //save the child open object in the packets
            //SendFlags |= NDIS_SEND_FLAGS_CHECK_FOR_LOOPBACK;

            // Recognize IEEE802.1Q tagged packet, as no many adapters support VLAN tag packet sending, no much use for end users,
            // and this code examines the data which lacks efficiency, so I left it commented, the sending part is also unfinished.
            // This code refers to Win10Pcap at https://github.com/SoftEtherVPN/Win10Pcap.
//          if (Open->Loopback == FALSE)
//          {
//              PUCHAR pHeaderBuffer;
//              UINT iFres;
//
//              BOOLEAN withVlanTag = FALSE;
//              UINT VlanID = 0;
//              UINT VlanUserPriority = 0;
//              UINT VlanCanFormatID = 0;
//
//              NdisQueryMdl(
//                  Irp->MdlAddress,
//                  &pHeaderBuffer,
//                  &iFres,
//                  NormalPagePriority);
//
//              // Determine if the packet is IEEE802.1Q tagged packet.
//              if (iFres >= 18)
//              {
//                  if (pHeaderBuffer[12] == 0x81 && pHeaderBuffer[13] == 0x00)
//                  {
//                      USHORT pTmpVlanTag = 0;
//
//                      ((UCHAR *)(&pTmpVlanTag))[0] = pHeaderBuffer[15];
//                      ((UCHAR *)(&pTmpVlanTag))[1] = pHeaderBuffer[14];
//
//                      VlanID = pTmpVlanTag & 0x0FFF;
//                      VlanUserPriority = (pTmpVlanTag >> 13) & 0x07;
//                      VlanCanFormatID = (pTmpVlanTag >> 12) & 0x01;
//
//                      if (VlanID != 0)
//                      {
//                          withVlanTag = TRUE;
//                      }
//                  }
//              }
//          }

            //
            //  Call the MAC
            //
#ifdef HAVE_WFP_LOOPBACK_SUPPORT
            if (Open->Loopback == TRUE)
            {
                NPF_LoopbackSendNetBufferLists(Open->GroupHead,
                    pNetBufferList);
            }
            else
#endif
#ifdef HAVE_SEND_TO_RECEIVE_PATH_SUPPORT
                if (Open->SendToRxPath == TRUE)
                {
                    IF_LOUD(DbgPrint("hahahahahahahahahahahaha:: SendToRxPath, Open->AdapterHandle=%p, pNetBufferList=%u\n", Open->AdapterHandle, pNetBufferList);)
                    // pretend to receive these packets from network and indicate them to upper layers
                    NdisFIndicateReceiveNetBufferLists(
                        Open->AdapterHandle,
                        pNetBufferList,
                        NDIS_DEFAULT_PORT_NUMBER,
                        1,
                        0);
                }
                else
#endif
                {
                    NdisFSendNetBufferLists(Open->AdapterHandle,
                        pNetBufferList,
                        NDIS_DEFAULT_PORT_NUMBER,
                        SendFlags);
                }

            numSentPackets ++;
        }
        else
        {
            //
            // no packets are available in the Transmit pool, wait some time. The 
            // event gets signalled when at least half of the TX packet pool packets
            // are available
            //
            NdisWaitEvent(&Open->WriteEvent, 1);
        }
    }

    //
    // when we reach this point, all the packets have been enqueued to NdisSend,
    // we just need to wait for all the packets to be completed by the SendComplete
    // (if any of the NdisSend requests returned STATUS_PENDING)
    //
    NdisWaitEvent(&Open->NdisWriteCompleteEvent, 0);

    //
    // all the packets have been transmitted, release the use of the adapter binding
    //
    NPF_StopUsingBinding(Open);

    //
    // no more writes are in progress
    //
    NdisAcquireSpinLock(&Open->WriteLock);
    Open->WriteInProgress = FALSE;
    NdisReleaseSpinLock(&Open->WriteLock);

    NPF_StopUsingOpenInstance(Open);

    //
    // Complete the Irp and return success
    //
    Irp->IoStatus.Status = STATUS_SUCCESS;
    Irp->IoStatus.Information = IrpSp->Parameters.Write.Length;
    IoCompleteRequest(Irp, IO_NO_INCREMENT);

    TRACE_EXIT();

    return STATUS_SUCCESS;
}

Мой обработчик FilterReturnNetBufferLists:

_Use_decl_annotations_
VOID
NPF_ReturnEx(
    NDIS_HANDLE         FilterModuleContext,
    PNET_BUFFER_LIST    NetBufferLists,
    ULONG               ReturnFlags
    )
/*++

Routine Description:

    FilterReturnNetBufferLists handler.
    FilterReturnNetBufferLists is an optional function. If provided, NDIS calls
    FilterReturnNetBufferLists to return the ownership of one or more NetBufferLists
    and their embedded NetBuffers to the filter driver. If this handler is NULL, NDIS
    will skip calling this filter when returning NetBufferLists to the underlying
    miniport and will call the next lower driver in the stack. A filter that doesn't
    provide a FilterReturnNetBufferLists handler cannot originate a receive indication
    on its own.

Arguments:

    FilterInstanceContext       - our filter context area
    NetBufferLists              - a linked list of NetBufferLists that this 
                                  filter driver indicated in a previous call to 
                                  NdisFIndicateReceiveNetBufferLists
    ReturnFlags                 - flags specifying if the caller is at DISPATCH_LEVEL

--*/
{
    POPEN_INSTANCE      ChildOpen;
    POPEN_INSTANCE      GroupOpen;
    POPEN_INSTANCE      TempOpen;
    BOOLEAN             FreeBufAfterWrite;
    PNET_BUFFER_LIST    pNetBufList;
    PNET_BUFFER_LIST    pNextNetBufList;
    PNET_BUFFER         Currbuff;
    PMDL                pMdl;
    POPEN_INSTANCE      Open = (POPEN_INSTANCE) FilterModuleContext;

    TRACE_ENTER();

#ifdef HAVE_SEND_TO_RECEIVE_PATH_SUPPORT
    pNetBufList = NetBufferLists;

    while (pNetBufList != NULL)
    {
        pNextNetBufList = NET_BUFFER_LIST_NEXT_NBL(pNetBufList);
        NET_BUFFER_LIST_NEXT_NBL(pNetBufList) = NULL;

        if (pNetBufList->SourceHandle == Open->AdapterHandle) //this is our self-sent packets
        {
            TRACE_MESSAGE(PACKET_DEBUG_LOUD, "hahahaha This is my own send to Rx packets");
            ChildOpen = NPFGetNBLChildOpen(pNetBufList); //get the child open object that sends these packets
            FreeBufAfterWrite = RESERVED(pNetBufList)->FreeBufAfterWrite;

            if (FreeBufAfterWrite)
            {
                //
                // Packet sent by NPF_BufferedWrite()
                //

                //Free the NBL allocate by myself
                Currbuff = NET_BUFFER_LIST_FIRST_NB(pNetBufList);
                while (Currbuff)
                {
                    pMdl = NET_BUFFER_FIRST_MDL(Currbuff);
                    NdisFreeMdl(pMdl); //Free MDL
                    Currbuff = NET_BUFFER_NEXT_NB(Currbuff);
                }
                NdisFreeNetBufferList(pNetBufList); //Free NBL
            }
            else
            {
                //
                // Packet sent by NPF_Write()
                //

                //Free the NBL allocate by myself
                NdisFreeNetBufferList(pNetBufList); //Free NBL
            }

            // this if should always be false, as Open is always the GroupHead itself, only GroupHead is known by NDIS and get invoked in NPF_SendCompleteEx() function.
            if (Open->GroupHead != NULL)
            {
                GroupOpen = Open->GroupHead->GroupNext;
            }
            else
            {
                GroupOpen = Open->GroupNext;
            }

            //GroupOpen = Open->GroupNext;

            while (GroupOpen != NULL)
            {
                TempOpen = GroupOpen;
                if (ChildOpen == TempOpen) //only indicate the specific child open object
                {
                    NPF_SendCompleteExForEachOpen(TempOpen, FreeBufAfterWrite);
                    break;
                }

                GroupOpen = TempOpen->GroupNext;
            }
        }
        else
        {
            TRACE_MESSAGE(PACKET_DEBUG_LOUD, "hahahaha This is NOT my own send to Rx packets");
            // Return the received NBLs.  If you removed any NBLs from the chain, make
            // sure the chain isn't empty (i.e., NetBufferLists!=NULL).
            NdisFReturnNetBufferLists(Open->AdapterHandle, pNetBufList, ReturnFlags);
        }

        pNetBufList = pNextNetBufList;
    }
#else
    // Return the received NBLs.  If you removed any NBLs from the chain, make
    // sure the chain isn't empty (i.e., NetBufferLists!=NULL).
    NdisFReturnNetBufferLists(Open->AdapterHandle, NetBufferLists, ReturnFlags);
#endif

    TRACE_EXIT();
}

Мой журнал:

00010269    58.36443710 MDL 42  
00010270    58.36444092 hahahahahahahahahahahaha:: SendToRxPath, Open->AdapterHandle=FFFFFA8003C24010, pNetBufferList=68928096  
00010271    58.36450577 --> NPF_ReturnEx    
00010272    58.36450577     NPF_ReturnEx: hahahaha This is my own send to Rx packets    
00010273    58.36451340 <-- NPF_ReturnEx    
00010274    59.04499054 --> NPF_NetworkClassify 
00010275    59.04499817 --> NPF_IsPacketSelfSent    
00010276    59.04499817 <-- NPF_IsPacketSelfSent    
00010277    59.04499817     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010278    59.04500961 <-- NPF_NetworkClassify 
00010279    59.04502869 --> NPF_SendEx  
00010280    59.04503632 --> NPF_SendCompleteEx  
00010281    59.04504395 <-- NPF_SendCompleteEx  
00010282    59.04504395 <-- NPF_SendEx  
00010283    59.04520798 --> NPF_NetworkClassify 
00010284    59.04520798 --> NPF_IsPacketSelfSent    
00010285    59.04521561 <-- NPF_IsPacketSelfSent    
00010286    59.04521561     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010287    59.04522324 <-- NPF_NetworkClassify 
00010288    59.04529953 --> NPF_SendEx  
00010289    59.04529953 --> NPF_SendCompleteEx  
00010290    59.04530716 <-- NPF_SendCompleteEx  
00010291    59.04530716 <-- NPF_SendEx  
00010292    59.04531097 --> NPF_NetworkClassify 
00010293    59.04531097 --> NPF_IsPacketSelfSent    
00010294    59.04531097 <-- NPF_IsPacketSelfSent    
00010295    59.04531860     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010296    59.04531860 <-- NPF_NetworkClassify 
00010297    59.04541397 --> NPF_NetworkClassify 
00010298    59.04541397 --> NPF_IsPacketSelfSent    
00010299    59.04541397 <-- NPF_IsPacketSelfSent    
00010300    59.04542160     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010301    59.04542160 <-- NPF_NetworkClassify 
00010302    59.04543304 --> NPF_SendEx  
00010303    59.04543304 Received on CPU 0  3    
00010304    59.04544067 Received on CPU 0  2    
00010305    59.04544067 MDL 62  
00010306    59.04544067 next MDL 24 and added   
00010307    59.04544830 --> NPF_SendCompleteEx  
00010308    59.04547882 <-- NPF_SendCompleteEx  
00010309    59.04548645 <-- NPF_SendEx  
00010310    59.04558563 --> NPF_NetworkClassify 
00010311    59.04558563 --> NPF_IsPacketSelfSent    
00010312    59.04558563 <-- NPF_IsPacketSelfSent    
00010313    59.04559326     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010314    59.04560089 <-- NPF_NetworkClassify 
00010315    59.04560471 --> NPF_SendEx  
00010316    59.04561234 Received on CPU 0  4    
00010317    59.04561234 Received on CPU 0  3    
00010318    59.04561234 MDL 42  
00010319    59.04561996 next MDL 24 and added   
00010320    59.04561996 --> NPF_SendCompleteEx  
00010321    59.04562378 <-- NPF_SendCompleteEx  
00010322    59.04562378 <-- NPF_SendEx  
00010323    59.15098953 --> NPF_NetworkClassify 
00010324    59.15098953 --> NPF_IsPacketSelfSent    
00010325    59.15099335 <-- NPF_IsPacketSelfSent    
00010326    59.15099335     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010327    59.15103912 <-- NPF_NetworkClassify 
00010328    59.15105820 --> NPF_SendEx  
00010329    59.15106583 --> NPF_SendCompleteEx  
00010330    59.15106583 <-- NPF_SendCompleteEx  
00010331    59.15106583 <-- NPF_SendEx  
00010332    59.15113449 --> NPF_NetworkClassify 
00010333    59.15113449 --> NPF_IsPacketSelfSent    
00010334    59.15114212 <-- NPF_IsPacketSelfSent    
00010335    59.15114212     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010336    59.15114975 <-- NPF_NetworkClassify 
00010337    59.15118027 --> NPF_SendEx  
00010338    59.15118027 --> NPF_SendCompleteEx  
00010339    59.15118790 <-- NPF_SendCompleteEx  
00010340    59.15118790 <-- NPF_SendEx  
00010341    59.15118790 --> NPF_NetworkClassify 
00010342    59.15119171 --> NPF_IsPacketSelfSent    
00010343    59.15119171 <-- NPF_IsPacketSelfSent    
00010344    59.15119171     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010345    59.15119934 <-- NPF_NetworkClassify 
00010346    59.15123367 --> NPF_NetworkClassify 
00010347    59.15123749 --> NPF_IsPacketSelfSent    
00010348    59.15123749 <-- NPF_IsPacketSelfSent    
00010349    59.15123749     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010350    59.15124512 <-- NPF_NetworkClassify 
00010351    59.15125275 --> NPF_SendEx  
00010352    59.15125275 Received on CPU 1  1    
00010353    59.15125656 Received on CPU 1  1    
00010354    59.15132904 MDL 62  
00010355    59.15133286 next MDL 24 and added   
00010356    59.15134048 --> NPF_SendCompleteEx  
00010357    59.15134811 <-- NPF_SendCompleteEx  
00010358    59.15134811 <-- NPF_SendEx  
00010359    59.15138626 --> NPF_NetworkClassify 
00010360    59.15138626 --> NPF_IsPacketSelfSent    
00010361    59.15138626 <-- NPF_IsPacketSelfSent    
00010362    59.15139389     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010363    59.15139771 <-- NPF_NetworkClassify 
00010364    59.15140533 --> NPF_SendEx  
00010365    59.15140533 Received on CPU 1  2    
00010366    59.15140533 Received on CPU 1  2    
00010367    59.15141296 MDL 42  
00010368    59.15141296 next MDL 24 and added   
00010369    59.15141296 --> NPF_SendCompleteEx  
00010370    59.15141678 <-- NPF_SendCompleteEx  
00010371    59.15141678 <-- NPF_SendEx  
00010372    59.19804001 --> NPF_SendEx  
00010373    59.19805527 --> NPF_SendCompleteEx  
00010374    59.19805527 <-- NPF_SendCompleteEx  
00010375    59.19805527 <-- NPF_SendEx  
00010376    59.35518646 --> NPF_NetworkClassify 
00010377    59.35519409 --> NPF_IsPacketSelfSent    
00010378    59.35519409 <-- NPF_IsPacketSelfSent    
00010379    59.35519409     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010380    59.35520554 <-- NPF_NetworkClassify 
00010381    59.35526276 --> NPF_SendEx  
00010382    59.35527039 --> NPF_SendCompleteEx  
00010383    59.35527802 <-- NPF_SendCompleteEx  
00010384    59.35527802 <-- NPF_SendEx  
00010385    59.35528183 --> NPF_NetworkClassify 
00010386    59.35528183 --> NPF_IsPacketSelfSent    
00010387    59.35528183 <-- NPF_IsPacketSelfSent    
00010388    59.35528946     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010389    59.35528946 <-- NPF_NetworkClassify 
00010390    59.35543823 --> NPF_NetworkClassify 
00010391    59.35543823 --> NPF_IsPacketSelfSent    
00010392    59.35543823 <-- NPF_IsPacketSelfSent    
00010393    59.35544205     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010394    59.35544968 <-- NPF_NetworkClassify 
00010395    59.35546112 --> NPF_SendEx  
00010396    59.35546875 Received on CPU 0  5    
00010397    59.35546875 Received on CPU 0  4    
00010398    59.35547638 MDL 42  
00010399    59.35547638 next MDL 50 and added   
00010400    59.35548019 --> NPF_SendCompleteEx  
00010401    59.35548019 <-- NPF_SendCompleteEx  
00010402    59.35548782 <-- NPF_SendEx  
00010403    59.47556305 --> NPF_TapEx   
00010404    59.47557068 --> NPF_ReturnEx    
00010405    59.47557068     NPF_ReturnEx: hahahaha This is NOT my own send to Rx packets    
00010406    59.47557068 <-- NPF_ReturnEx    
00010407    59.47557831 <-- NPF_TapEx   
00010408    59.58328247 --> NPF_TapEx   
00010409    59.58329773 --> NPF_ReturnEx    
00010410    59.58329773     NPF_ReturnEx: hahahaha This is NOT my own send to Rx packets    
00010411    59.58329773 <-- NPF_ReturnEx    
00010412    59.58329773 <-- NPF_TapEx   
00010413    59.58549881 --> NPF_TapEx   
00010414    59.58550262 --> NPF_ReturnEx    
00010415    59.58551025     NPF_ReturnEx: hahahaha This is NOT my own send to Rx packets    
00010416    59.58551025 <-- NPF_ReturnEx    
00010417    59.58551025 <-- NPF_TapEx   
00010418    60.11791992 --> NPF_NetworkClassify 
00010419    60.11791992 --> NPF_IsPacketSelfSent    
00010420    60.11792755 <-- NPF_IsPacketSelfSent    
00010421    60.11792755     NPF_NetworkClassify: NPF_NetworkClassify: NPF_IsPacketSelfSent() [bSelfSent: 0] 
00010422    60.11793900 <-- NPF_NetworkClassify 
00010423    60.11795807 --> NPF_SendEx  
00010424    60.11796570 Received on CPU 0  6    
00010425    60.11796570 Received on CPU 0  5    
00010426    60.11796951 MDL 42  
00010427    60.11796951 next MDL 50 and added