Windows Network Data Filtering Techniques

川长思鸟来 2022-08-24 01:30 257阅读 0赞

<table> 
 <tbody> 
 <tr> 
 <td><h1>Windows Network Data and Packet Filtering &nbsp;</h1>The purpose of this topic is to provide a brief introduction to various techniques that can be used to filter network data and network packets on the Microsoft Windows platforms..&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h1>Network Architecture Diagram</h1>Preliminary...<img src="http://www.ndis.com/images/netuser.gif" width="609" height="458"><img src="http://www.ndis.com/images/netkernel.gif" width="609" height="732">&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h1>&nbsp;Windows Network Data Filtering Techniques</h1> 
 <table> 
 <tbody> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#UserMode" rel="nofollow">User-Mode Network Data Filtering</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#WinsockLSP" rel="nofollow">Winsock Layered Service Provider (LSP)</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#W2KPktFilterInterface" rel="nofollow">Windows 2000 Packet Filtering Interface</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#WinsockReplacement" rel="nofollow">Winsock Replacement DLL</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#KernelMode" rel="nofollow">Kernel-Mode Network Data Filtering</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#TDIFilter" rel="nofollow">Transport Data Interface (TDI) Filter Driver</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#NDISIM" rel="nofollow">NDIS Intermediate (IM) Driver</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#FilterHook" rel="nofollow">Windows 2000 Filter-Hook Driver</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#W2KFirewallHook" rel="nofollow">Windows 2000 Firewall-Hook Driver</a></td> 
 </tr> 
 <tr> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#NDISHook" rel="nofollow">NDIS-Hooking Filter Driver</a></td> 
 </tr> 
 </tbody> 
 </table>&nbsp;<h2>Other Information</h2> 
 <table> 
 <tbody> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#Process%20Information" rel="nofollow">Network Operations And Process Information</a></td> 
 </tr> 
 </tbody> 
 </table>&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h1><a rel="nofollow">User-Mode Network Data Filtering</a></h1> 
 <table> 
 <tbody> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#WinsockLSP" rel="nofollow">Winsock Layered Service Provider (LSP)</a></td> 
 </tr> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#W2KPktFilterInterface" rel="nofollow">Windows 2000 Packet Filtering Interface</a></td> 
 </tr> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#WinsockReplacement" rel="nofollow">Winsock Replacement DLL</a></td> 
 </tr> 
 </tbody> 
 </table>&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h2><a rel="nofollow">Winsock Layered Service Provider (LSP)</a></h2>See documentation&nbsp;and LSP samples&nbsp;in the&nbsp;<a href="http://www.microsoft.com/msdownload/platformsdk/sdkupdate/" rel="nofollow">Microsoft Platform SDK</a>. 
 <blockquote> 
 <img src="http://www.ndis.com/images/warning.gif" width="28" height="28">&nbsp;There are several versions of the Microsoft LSP sample available. However, the latest (and most bug-free) is always on the Platform SDK. 
 </blockquote>Understand that it is possible to call the kernel-mode TCP/IP driver via the Transport Data Interface (TDI), and completely bypass Winsock. This limitation does not matter in many cases. For example, implementation of QOS could be done in a Winsock LSP.However, products that absolutely must inspect or manipulate every packet cannot rely on Winsock LSP. They must be implemented using a kernel-mode approach.&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h2><a rel="nofollow">Windows 2000 Packet Filtering Interface</a></h2>The Windows 2000 Packet Filtering Interface provides a mechanism that allows a user-mode application or service to specify a set of "filter descriptors" that are used by lower-level TCP/IP components to filter packets. Filtering is controls pass/drop of packets based on IP source and destination address and port numbers (and port number range).&nbsp;<h3>Windows Developer's Journal</h3>Packet Filtering with iphlpapi.dll,&nbsp;Windows Developer's Journal, Ton Plooy, Windows Developers Journal, October, 2000, Volume 11, Number 10. 
 <dl> 
 <dd> 
 Windows 2000 offers a finer degree of programmatic control over TCP/IP, including the ability to perform packet filtering. Unfortunately, the documentation for this new API doesn't make it easy to figure out. This article demonstrates how you can programmatically install filters to block packets going to or from specific IP addresses, on some or all TCP ports. 
 </dd> 
 </dl>[&nbsp;<a href="http://www.wdj.com/" rel="nofollow">Windows Developer's Journal Home...</a>&nbsp;<img src="http://www.ndis.com/images/leave-site.gif" width="17" height="11">&nbsp;] [&nbsp;<a href="ftp://ftp.wdj.com/pub/webzip/1110/plooy.zip" rel="nofollow">Download Ton Plooy's Sample Code from WDJ...</a>&nbsp;<img src="http://www.ndis.com/images/leave-site.gif" width="17" height="11">&nbsp;]&nbsp;<h3>Hollis Technology Solutions</h3>The HTS W2K IpHook! sample demonstrates the semi-documented IP filter driver and its Hook API. Source code included, and its Free! Also requires requires HtsCpp runtime library (Freeware).[&nbsp;<a href="http://www.hollistech.com/" rel="nofollow">Hollis Technology Solutions</a>&nbsp;<img src="http://www.ndis.com/images/leave-site.gif" width="17" height="11">]&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h2><a rel="nofollow">Winsock Replacement DLL</a></h2>Before the introduction of the Winsock Layered Service Provider (LSP) facility, the only way to extend the functionality of Winsock was to replace certain Microsoft-provided Winsock DLLs with replacement DLLs.If properly implemented, the replacement DLLs would filter the Winsock API and call functions in the original Winsock DLL as necessary.There are a variety of reasons why development of a robust Winsock replacement DLL is difficult to accomplish. Among these difficulties is the fact that the Microsoft Winsock DLL includes private internal support functions that are not documented. A Winsock replacement DLL must deal with at least some of these undocumented functions.The Windows system architecture is migrating to include enhancements, such as System File Protection, that make it impractical to use this technique.Overall, use of the Winsock replacement DLL in now a bad idea.More when I get a chance...&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10">&nbsp;<h1><a rel="nofollow">Kernel-Mode Network Data Filtering</a></h1> 
 <table> 
 <tbody> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#TDIFilter" rel="nofollow">Transport Data Interface (TDI) Filter Driver</a></td> 
 </tr> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#NDISIM" rel="nofollow">NDIS Intermediate (IM) Driver</a></td> 
 </tr> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#FilterHook" rel="nofollow">Windows 2000 Filter-Hook Driver</a></td> 
 </tr> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#W2KFirewallHook" rel="nofollow">Windows 2000 Firewall-Hook Driver</a></td> 
 </tr> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td><a href="http://www.ndis.com/papers/winpktfilter.htm#NDISHook" rel="nofollow">NDIS Hooking Filter Driver</a></td> 
 </tr> 
 </tbody> 
 </table>&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h2><a rel="nofollow">Transport Data Interface (TDI) Filter Driver</a></h2>This is basically a filter driver immediately above the kernel-mode TCP/IP driver.Through Windows XP the TDI driver is a classical NT-style "legacy" driver that uses an I/O Request Packet (IRP) based API. There are two basic ways to filter an IRP-based API: 
 <ol> 
 <li>Use the IoAttachDeviceXYZ family of kernel mode services to layer a filter above TDI.</li> 
 <li>Filter the TDI driver IRP dispatch table.</li> 
 </ol>The use of IoAttachDeviceXYZ API is described in most books on advanced Windows NT driver development.Both techniques for filtering TDI require a thorough understanding on Windows NT device driver programming techniques as well as a thorough understanding of the TDI API that is to be filtered.&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h2><a rel="nofollow">NDIS Intermediate (IM) Driver</a></h2>See the NDIS Intermediate (IM) Driver FAQ for some information.[&nbsp;<a href="http://www.pcausa.com/resources/ndisimfaq.htm" rel="nofollow">NDIS IM FAQ</a>&nbsp;]&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h2><a rel="nofollow">Windows 2000 Filter-Hook Driver</a></h2>See Windows 2000 DDK documentation.Only one Filter-Hook may be active. This appears to severely limit the usefulness of this mechanism.&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h2><a rel="nofollow">Windows 2000 Firewall-Hook Driver</a></h2>The Firewall-Hook Driver API introduced briefly in some Windows 2000 Betas proved inadequate for use. See Microsoft's comments about&nbsp;<a href="http://msdn.microsoft.com/library/default.asp?url=/library/en-us/network/hh/network/firewall_3wfb.asp" rel="nofollow">Fire-Wall Hook API.</a>More when I get a chance...&nbsp;<img src="http://www.ndis.com/_themes/ndis/watrule.gif" width="600" height="10"><h2><a rel="nofollow">NDIS-Hooking Filter Driver</a></h2>NDIS-hooking filter drivers intercept or "hook" selected functions exported by the NDIS wrapper.&nbsp; Although conceptually "drastic" approach, a systematically implemented NDIS-hooking filter can be quite effective.In addition, a NDIS-hooking filter driver is: 
 <table> 
 <tbody> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td>Easy to install</td> 
 </tr> 
 <tr> 
 <td><img src="http://www.ndis.com/_themes/ndis/watbul1.gif" width="12" height="12" alt="bullet"></td> 
 <td>Intrinsically supports filtering over the Dialup-PPP adapter</td> 
 </tr> 
 </tbody> 
 </table>The NDIS-hooking technique is&nbsp;effective and practical on the Windows 9X and Windows Millennium platforms. On these platforms hooking can be implemented using the Microsoft DDK documentation as a guide and documented Microsoft-provided services to hook functions exported by the NDIS wrapper.The&nbsp;<a href="http://www.pcausa.com/ndispim9x/Default.htm" rel="nofollow">PCAUSA NDIS Pseudo-Intermediate (PIM) Driver</a>&nbsp;is an example of a NDIS-Hooking Filter Driver.The NDIS-hooking technique is equally&nbsp; effective and practical on Windows NT, Windows 2000 and Windows XP. However, the hooking techniques are more akin to the techniques used by kernel-mode debuggers. That is, they are less well documented and may be difficult to be certified by WHQL for driver signing. 
 <blockquote> 
 PCAUSA is provides a suite of NDIS PIM driver samples that operate successfully over the entire range of current Windows platforms (Windows 95 through Windows XP). 
 [&nbsp;<a href="http://www.pcausa.com/ndispim/Default.htm" rel="nofollow">PCAUSA NDIS-Hooking Driver Samples...&nbsp;</a>] 
 </blockquote>More when I get a chance...&nbsp;<h1><a rel="nofollow">Other Considerations</a></h1><h2><a rel="nofollow">Network Operations And Process Information</a></h2>It may be desired to make a correlation between network operations and the Windows process (application) associated with those operations. For example, it may be of interest to know which process (application) is sending or receiving data on a particular IP port.Without exploring the real problem of whether or not this is actually useful or reliable we can say that filters above the kernel-mode TCP/IP driver can correlate network operations with the associated Windows process. Filters below the kernel-mode TCP/IP driver do not have visibility to process information.It should also be noted that some network services operate by creating a thread attached to the system process. In this case the process information that is available does not specifically identify the actual process that initially created the thread. This is especially true of Windows services that exist solely in kernel-mode (kernel-mode TDI clients).Finally, one should examine the following Patent before considering use of process information to filter internet access: 
 <blockquote> 
 United States Patent 5,987,611; "System and methodology for managing internet access on a per application basis for client computers connected to the internet ". 
 </blockquote>PCAUSA does not know the merits of this Patent or how it may apply to any intended use in packet filtering. Details can be found by searching for U.S. Patent 5,987,611 at the&nbsp;<a href="http://www.uspto.gov/patft/index.html" rel="nofollow">U.S. Patent Office website</a>.&nbsp;&nbsp; 
 <table> 
 <tbody> 
 <tr> 
 <td colspan="2">Topic Status</td> 
 </tr> 
 <tr> 
 <td>December, 2002</td> 
 <td>Reviewed and moved to NDIS.com.</td> 
 </tr> 
 <tr> 
 <td>February, 2001</td> 
 <td>Added preliminary diagrams.</td> 
 </tr> 
 <tr> 
 <td>January, 2001</td> 
 <td>Added link to Hollis Technology Solutions sample.</td> 
 </tr> 
 <tr> 
 <td>October, 2001</td> 
 <td>Just a start with Ton Plooy's article on W2K IPHlpApi DLL.</td> 
 </tr> 
 </tbody> 
 </table></td> 
 </tr> 
 </tbody> 
</table>