LWF unable to change NdisGeneralAttributes->MtuSize

[Soquel Dude]

I am writing an NDIS LWF driver that requires a custom MAC header inside the LAN frame. During the filter's RestartHandler, the driver will reduce the NDIS_RESTART_GENERAL_ATTRIBUTES.MtuSize to a value that would accommodate the space that is needed.

Under Windows 10.0.18363 on a VM, I see the following behavior:

1. I install my driver and let it run in pass-thru mode. In this mode, it should reduce the MTU but not alter the frame contents. I verified that the MTU size is reduced correctly. The driver also filters the OID query of OID_GEN_MAXIMUM_TOTAL_SIZE and returns a reduced value consistent with the new MTU.
   
2. On a DOS window, I start "ping www.yahoo.com -t -l 16000" so I can monitor the frame lengths with Wireshark running on the host system. I use "-l 16000" so I can see multiple max MTU packets sent from the VM.
   
   
3. Under Wireshark, I see that all egress packets send through my driver are still 1514 and not the reduced total frame length.
   
   
4. If I then disable/enable the underlying network device to force a reattachment of my LWF and then restart the ping, I see that egress frames are reduced in size from 1514.

I cannot understand why the first filter attach doesn't change the MTU correctly while subsequent detach/attach calls to the driver does change the MTU.

Does anybody have any suggestions on what I can do next?

Thanks!

Continue reading...