NDIS IM Layering

According to the WDK documentation, you cannot have more than one NDIS IM
driver of a particular FilterClass (scheduler, loadbalance, failover) in a
stack. This is found under the topic "Filter Intermediate Driver
Installation (NDIS 5.1)".

In practice, I was able to install the WDK sample PassThru and our own
driver which is based on PassThru with no observable problems. Both drivers
have their FilterClass specified as failover in their respective INF files.

Am I misunderstanding something here? Is the documentation making a
recommendation instead of stating policy?

AntonBassov
Sat Jul 07 05:56:01 CDT 2007

> In practice, I was able to install the WDK sample PassThru and our own
> driver which is based on PassThru with no observable problems. Both drivers
> have their FilterClass specified as failover in their respective INF files.
>
> Am I misunderstanding something here? Is the documentation making a
> recommendation instead of stating policy?

As you have experimentally established, this is just one more MSDN claim
that proved to be false, at least in respect of failover drivers. Another
similar claim can be found in NDIS 6 documentation - MSDN claims that you
cannot have more than one modifying LWF in the same stack, and this claim is
false as well.....

Anton Bassov

"tnili" wrote:

> According to the WDK documentation, you cannot have more than one NDIS IM
> driver of a particular FilterClass (scheduler, loadbalance, failover) in a
> stack. This is found under the topic "Filter Intermediate Driver
> Installation (NDIS 5.1)".
>
> In practice, I was able to install the WDK sample PassThru and our own
> driver which is based on PassThru with no observable problems. Both drivers
> have their FilterClass specified as failover in their respective INF files.
>
> Am I misunderstanding something here? Is the documentation making a
> recommendation instead of stating policy?
>
>
>

SteveJackowski
Sun Jul 08 22:42:00 CDT 2007

While what Anton says is basically true - you can have multiple IMs in a
filter class - there is no guarantee that this will work as expected,
particularly if one IM consumes packets that another needs. There's no
guarantee of ordering unless you do a lot of extra work to ensure your
ordering. Often, who gets the packets first is determined by installation
order.

So, I think Microsoft's point is a bit more than a recommendation; it's a
note of caution.


Steve

"Anton Bassov" wrote:

> > In practice, I was able to install the WDK sample PassThru and our own
> > driver which is based on PassThru with no observable problems. Both drivers
> > have their FilterClass specified as failover in their respective INF files.
> >
> > Am I misunderstanding something here? Is the documentation making a
> > recommendation instead of stating policy?
>
> As you have experimentally established, this is just one more MSDN claim
> that proved to be false, at least in respect of failover drivers. Another
> similar claim can be found in NDIS 6 documentation - MSDN claims that you
> cannot have more than one modifying LWF in the same stack, and this claim is
> false as well.....
>
> Anton Bassov
>
> "tnili" wrote:
>
> > According to the WDK documentation, you cannot have more than one NDIS IM
> > driver of a particular FilterClass (scheduler, loadbalance, failover) in a
> > stack. This is found under the topic "Filter Intermediate Driver
> > Installation (NDIS 5.1)".
> >
> > In practice, I was able to install the WDK sample PassThru and our own
> > driver which is based on PassThru with no observable problems. Both drivers
> > have their FilterClass specified as failover in their respective INF files.
> >
> > Am I misunderstanding something here? Is the documentation making a
> > recommendation instead of stating policy?
> >
> >
> >

AntonBassov
Mon Jul 09 02:00:02 CDT 2007

> So, I think Microsoft's point is a bit more than a recommendation; it's a
> note of caution.

It is neither recommendation nor caution, because it does not allow any
theoretical possibilities - instead, it is a very precise directive that just
turned out to be false. Let's look at how MSDN put it:

[begin quote]

Only one filter intermediate driver of a specific class can exist in a
layered stack of filter intermediate drivers. For example, two filter
intermediate drivers of FilterClass "schedule" cannot exist in a stack
simultaneously.

[end quote]

As you can see, the above statement does not leave any possibilities, not
even theoretical ones - instead, it implies that you are just unable to
install driver X if driver Y of the same class is around.


Anton Bassov

"Steve Jackowski" wrote:

> While what Anton says is basically true - you can have multiple IMs in a
> filter class - there is no guarantee that this will work as expected,
> particularly if one IM consumes packets that another needs. There's no
> guarantee of ordering unless you do a lot of extra work to ensure your
> ordering. Often, who gets the packets first is determined by installation
> order.
>
> So, I think Microsoft's point is a bit more than a recommendation; it's a
> note of caution.
>
>
> Steve
>
> "Anton Bassov" wrote:
>
> > > In practice, I was able to install the WDK sample PassThru and our own
> > > driver which is based on PassThru with no observable problems. Both drivers
> > > have their FilterClass specified as failover in their respective INF files.
> > >
> > > Am I misunderstanding something here? Is the documentation making a
> > > recommendation instead of stating policy?
> >
> > As you have experimentally established, this is just one more MSDN claim
> > that proved to be false, at least in respect of failover drivers. Another
> > similar claim can be found in NDIS 6 documentation - MSDN claims that you
> > cannot have more than one modifying LWF in the same stack, and this claim is
> > false as well.....
> >
> > Anton Bassov
> >
> > "tnili" wrote:
> >
> > > According to the WDK documentation, you cannot have more than one NDIS IM
> > > driver of a particular FilterClass (scheduler, loadbalance, failover) in a
> > > stack. This is found under the topic "Filter Intermediate Driver
> > > Installation (NDIS 5.1)".
> > >
> > > In practice, I was able to install the WDK sample PassThru and our own
> > > driver which is based on PassThru with no observable problems. Both drivers
> > > have their FilterClass specified as failover in their respective INF files.
> > >
> > > Am I misunderstanding something here? Is the documentation making a
> > > recommendation instead of stating policy?
> > >
> > >
> > >

SteveJackowski
Mon Jul 09 07:46:02 CDT 2007

Anton,

Obviously your statement is true, and obviously the fact is that you can run
multiple IMs in the same Filter Class. My point remains the same - if you do
this, you need to be careful for the reasons previously stated.


Steve

"Anton Bassov" wrote:

> > So, I think Microsoft's point is a bit more than a recommendation; it's a
> > note of caution.
>
> It is neither recommendation nor caution, because it does not allow any
> theoretical possibilities - instead, it is a very precise directive that just
> turned out to be false. Let's look at how MSDN put it:
>
> [begin quote]
>
> Only one filter intermediate driver of a specific class can exist in a
> layered stack of filter intermediate drivers. For example, two filter
> intermediate drivers of FilterClass "schedule" cannot exist in a stack
> simultaneously.
>
> [end quote]
>
> As you can see, the above statement does not leave any possibilities, not
> even theoretical ones - instead, it implies that you are just unable to
> install driver X if driver Y of the same class is around.
>
>
> Anton Bassov
>
> "Steve Jackowski" wrote:
>
> > While what Anton says is basically true - you can have multiple IMs in a
> > filter class - there is no guarantee that this will work as expected,
> > particularly if one IM consumes packets that another needs. There's no
> > guarantee of ordering unless you do a lot of extra work to ensure your
> > ordering. Often, who gets the packets first is determined by installation
> > order.
> >
> > So, I think Microsoft's point is a bit more than a recommendation; it's a
> > note of caution.
> >
> >
> > Steve
> >
> > "Anton Bassov" wrote:
> >
> > > > In practice, I was able to install the WDK sample PassThru and our own
> > > > driver which is based on PassThru with no observable problems. Both drivers
> > > > have their FilterClass specified as failover in their respective INF files.
> > > >
> > > > Am I misunderstanding something here? Is the documentation making a
> > > > recommendation instead of stating policy?
> > >
> > > As you have experimentally established, this is just one more MSDN claim
> > > that proved to be false, at least in respect of failover drivers. Another
> > > similar claim can be found in NDIS 6 documentation - MSDN claims that you
> > > cannot have more than one modifying LWF in the same stack, and this claim is
> > > false as well.....
> > >
> > > Anton Bassov
> > >
> > > "tnili" wrote:
> > >
> > > > According to the WDK documentation, you cannot have more than one NDIS IM
> > > > driver of a particular FilterClass (scheduler, loadbalance, failover) in a
> > > > stack. This is found under the topic "Filter Intermediate Driver
> > > > Installation (NDIS 5.1)".
> > > >
> > > > In practice, I was able to install the WDK sample PassThru and our own
> > > > driver which is based on PassThru with no observable problems. Both drivers
> > > > have their FilterClass specified as failover in their respective INF files.
> > > >
> > > > Am I misunderstanding something here? Is the documentation making a
> > > > recommendation instead of stating policy?
> > > >
> > > >
> > > >

Thomas
Mon Jul 09 23:19:24 CDT 2007


"Anton Bassov" <AntonBassov@discussions.microsoft.com> wrote in message
news:6D79BA59-382C-4918-B738-2B808429CC22@microsoft.com...
>> In practice, I was able to install the WDK sample PassThru and our own
>> driver which is based on PassThru with no observable problems. Both
>> drivers
>> have their FilterClass specified as failover in their respective INF
>> files.
>>
>> Am I misunderstanding something here? Is the documentation making a
>> recommendation instead of stating policy?
>
> As you have experimentally established, this is just one more MSDN claim
> that proved to be false, at least in respect of failover drivers. Another
> similar claim can be found in NDIS 6 documentation - MSDN claims that you
> cannot have more than one modifying LWF in the same stack, and this claim
> is
> false as well.....

I believe that you can read this claim a little differently.

In particular, you can only have one instance of your own modifying LWF on
the same stack. For example, if you have a LWF that can bind to 802.3 and
WLAN, then it will bind to one or the other but not both. In this case, the
modifying driver will probably bind as 802.3 above the Microsoft Native
Wi-Fi driver but will not bind a second time below the Native Wi-Fi filter.

A modifying filter setup to bind to 802.3 and WLAN will behave differently
and will, in fact, bind itself twice on the same stack.

Agreed that the doc isn't crystal clear, but sometimes you have to
experiment a little to find what they really meant.

Thomas F. Divine

>
> Anton Bassov
>
> "tnili" wrote:
>
>> According to the WDK documentation, you cannot have more than one NDIS IM
>> driver of a particular FilterClass (scheduler, loadbalance, failover) in
>> a
>> stack. This is found under the topic "Filter Intermediate Driver
>> Installation (NDIS 5.1)".
>>
>> In practice, I was able to install the WDK sample PassThru and our own
>> driver which is based on PassThru with no observable problems. Both
>> drivers
>> have their FilterClass specified as failover in their respective INF
>> files.
>>
>> Am I misunderstanding something here? Is the documentation making a
>> recommendation instead of stating policy?
>>
>>
>>

mirage2k2
Tue Jul 10 00:28:01 CDT 2007

My experience is that you can have more than one IM installed at a time. My
IM driver is often installed on systems that have VPN products installed,
i.e. Cisco VPN client which uses Deterministic IM driver. The only problem I
have encountered is the load order in the stack - there is no guarantee of
order, your IM might live above the other IM or below it. To a degree this
can be controlled by changing the FilterClass value in the protocol inf. For
my product I need my IM to always be at the top so I have set FilterClass to
scheduler - this makes the IM go higher in the stack. Most other IMs use
FilterClass = failover/loadbalance - those values make your IM go lower in
the stack. I am lucky because I need to go higher and everyone else wants to
go lower. Your situation may be different. If 2 IMs both have the same
FilterClass then there is no (easy) way to control load order.

The only way I know to change load order for 2 IMs with the same FilterClass
is to manually (or programmaticaly) edit the bindings in the registry ... see
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}

Each device is listed here and contains a Linkage key which specifies
RootDevice and UpperBind - these can be changed appropriately but bear in
mind 2 things, 1) I have never tried changing load order by editing these
values (although in theory it should work) and 2) do it wrong and you might
be left with a machine that needs rebuilding! For XP do a system restore
point first!

It may also be possible to change load order programmatically using
snetcfg.exe but I don't know! Does anyone?

Mirage2k2.

"Thomas F. Divine" wrote:

>
> "Anton Bassov" <AntonBassov@discussions.microsoft.com> wrote in message
> news:6D79BA59-382C-4918-B738-2B808429CC22@microsoft.com...
> >> In practice, I was able to install the WDK sample PassThru and our own
> >> driver which is based on PassThru with no observable problems. Both
> >> drivers
> >> have their FilterClass specified as failover in their respective INF
> >> files.
> >>
> >> Am I misunderstanding something here? Is the documentation making a
> >> recommendation instead of stating policy?
> >
> > As you have experimentally established, this is just one more MSDN claim
> > that proved to be false, at least in respect of failover drivers. Another
> > similar claim can be found in NDIS 6 documentation - MSDN claims that you
> > cannot have more than one modifying LWF in the same stack, and this claim
> > is
> > false as well.....
>
> I believe that you can read this claim a little differently.
>
> In particular, you can only have one instance of your own modifying LWF on
> the same stack. For example, if you have a LWF that can bind to 802.3 and
> WLAN, then it will bind to one or the other but not both. In this case, the
> modifying driver will probably bind as 802.3 above the Microsoft Native
> Wi-Fi driver but will not bind a second time below the Native Wi-Fi filter.
>
> A modifying filter setup to bind to 802.3 and WLAN will behave differently
> and will, in fact, bind itself twice on the same stack.
>
> Agreed that the doc isn't crystal clear, but sometimes you have to
> experiment a little to find what they really meant.
>
> Thomas F. Divine
>
> >
> > Anton Bassov
> >
> > "tnili" wrote:
> >
> >> According to the WDK documentation, you cannot have more than one NDIS IM
> >> driver of a particular FilterClass (scheduler, loadbalance, failover) in
> >> a
> >> stack. This is found under the topic "Filter Intermediate Driver
> >> Installation (NDIS 5.1)".
> >>
> >> In practice, I was able to install the WDK sample PassThru and our own
> >> driver which is based on PassThru with no observable problems. Both
> >> drivers
> >> have their FilterClass specified as failover in their respective INF
> >> files.
> >>
> >> Am I misunderstanding something here? Is the documentation making a
> >> recommendation instead of stating policy?
> >>
> >>
> >>
>
>

AntonBassov
Tue Jul 10 04:10:02 CDT 2007

Thomas,

> Agreed that the doc isn't crystal clear, but sometimes you have to
> experiment a little to find what they really meant.

This is EXACTLY what the problem is all about - sometimes, in order to
understand what the doc *wants* to say, you have to experiment with your
code and/or disassemble the OS, and sometimes you may discover that
something the doc *wants* to say is somehow different from what it
*actually* says. However, at this point the practical usefullness of the doc
becomes questionable - after all, the very idea of documentation is to help
you with the development and to spare you all the trouble of doing your own
investigations.....

I think the problem lies with misunderstanding between those who write docs
and those who write the actual code. Unfortunately, in a company as large as
MSFT it is just inevitable, so that MSDN bugs are, apparently, not going
anywhere anytime soon (if ever).....


Anton Bassov

"Thomas F. Divine" wrote:

>
> "Anton Bassov" <AntonBassov@discussions.microsoft.com> wrote in message
> news:6D79BA59-382C-4918-B738-2B808429CC22@microsoft.com...
> >> In practice, I was able to install the WDK sample PassThru and our own
> >> driver which is based on PassThru with no observable problems. Both
> >> drivers
> >> have their FilterClass specified as failover in their respective INF
> >> files.
> >>
> >> Am I misunderstanding something here? Is the documentation making a
> >> recommendation instead of stating policy?
> >
> > As you have experimentally established, this is just one more MSDN claim
> > that proved to be false, at least in respect of failover drivers. Another
> > similar claim can be found in NDIS 6 documentation - MSDN claims that you
> > cannot have more than one modifying LWF in the same stack, and this claim
> > is
> > false as well.....
>
> I believe that you can read this claim a little differently.
>
> In particular, you can only have one instance of your own modifying LWF on
> the same stack. For example, if you have a LWF that can bind to 802.3 and
> WLAN, then it will bind to one or the other but not both. In this case, the
> modifying driver will probably bind as 802.3 above the Microsoft Native
> Wi-Fi driver but will not bind a second time below the Native Wi-Fi filter.
>
> A modifying filter setup to bind to 802.3 and WLAN will behave differently
> and will, in fact, bind itself twice on the same stack.
>
> Agreed that the doc isn't crystal clear, but sometimes you have to
> experiment a little to find what they really meant.
>
> Thomas F. Divine
>
> >
> > Anton Bassov
> >
> > "tnili" wrote:
> >
> >> According to the WDK documentation, you cannot have more than one NDIS IM
> >> driver of a particular FilterClass (scheduler, loadbalance, failover) in
> >> a
> >> stack. This is found under the topic "Filter Intermediate Driver
> >> Installation (NDIS 5.1)".
> >>
> >> In practice, I was able to install the WDK sample PassThru and our own
> >> driver which is based on PassThru with no observable problems. Both
> >> drivers
> >> have their FilterClass specified as failover in their respective INF
> >> files.
> >>
> >> Am I misunderstanding something here? Is the documentation making a
> >> recommendation instead of stating policy?
> >>
> >>
> >>
>
>

Arkady
Tue Jul 10 07:07:20 CDT 2007

Look at directory src\network\config\bindview in ddk
Arkady

"mirage2k2" <mirage2k2@discussions.microsoft.com> wrote in message
news:FBB4419A-D48A-4D19-A80E-F5A5356A81B8@microsoft.com...
> My experience is that you can have more than one IM installed at a time.
> My
> IM driver is often installed on systems that have VPN products installed,
> i.e. Cisco VPN client which uses Deterministic IM driver. The only
> problem I
> have encountered is the load order in the stack - there is no guarantee of
> order, your IM might live above the other IM or below it. To a degree
> this
> can be controlled by changing the FilterClass value in the protocol inf.
> For
> my product I need my IM to always be at the top so I have set FilterClass
> to
> scheduler - this makes the IM go higher in the stack. Most other IMs use
> FilterClass = failover/loadbalance - those values make your IM go lower in
> the stack. I am lucky because I need to go higher and everyone else wants
> to
> go lower. Your situation may be different. If 2 IMs both have the same
> FilterClass then there is no (easy) way to control load order.
>
> The only way I know to change load order for 2 IMs with the same
> FilterClass
> is to manually (or programmaticaly) edit the bindings in the registry ...
> see
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}
>
> Each device is listed here and contains a Linkage key which specifies
> RootDevice and UpperBind - these can be changed appropriately but bear in
> mind 2 things, 1) I have never tried changing load order by editing these
> values (although in theory it should work) and 2) do it wrong and you
> might
> be left with a machine that needs rebuilding! For XP do a system restore
> point first!
>
> It may also be possible to change load order programmatically using
> snetcfg.exe but I don't know! Does anyone?
>
> Mirage2k2.
>
> "Thomas F. Divine" wrote:
>
>>
>> "Anton Bassov" <AntonBassov@discussions.microsoft.com> wrote in message
>> news:6D79BA59-382C-4918-B738-2B808429CC22@microsoft.com...
>> >> In practice, I was able to install the WDK sample PassThru and our own
>> >> driver which is based on PassThru with no observable problems. Both
>> >> drivers
>> >> have their FilterClass specified as failover in their respective INF
>> >> files.
>> >>
>> >> Am I misunderstanding something here? Is the documentation making a
>> >> recommendation instead of stating policy?
>> >
>> > As you have experimentally established, this is just one more MSDN
>> > claim
>> > that proved to be false, at least in respect of failover drivers.
>> > Another
>> > similar claim can be found in NDIS 6 documentation - MSDN claims that
>> > you
>> > cannot have more than one modifying LWF in the same stack, and this
>> > claim
>> > is
>> > false as well.....
>>
>> I believe that you can read this claim a little differently.
>>
>> In particular, you can only have one instance of your own modifying LWF
>> on
>> the same stack. For example, if you have a LWF that can bind to 802.3 and
>> WLAN, then it will bind to one or the other but not both. In this case,
>> the
>> modifying driver will probably bind as 802.3 above the Microsoft Native
>> Wi-Fi driver but will not bind a second time below the Native Wi-Fi
>> filter.
>>
>> A modifying filter setup to bind to 802.3 and WLAN will behave
>> differently
>> and will, in fact, bind itself twice on the same stack.
>>
>> Agreed that the doc isn't crystal clear, but sometimes you have to
>> experiment a little to find what they really meant.
>>
>> Thomas F. Divine
>>
>> >
>> > Anton Bassov
>> >
>> > "tnili" wrote:
>> >
>> >> According to the WDK documentation, you cannot have more than one NDIS
>> >> IM
>> >> driver of a particular FilterClass (scheduler, loadbalance, failover)
>> >> in
>> >> a
>> >> stack. This is found under the topic "Filter Intermediate Driver
>> >> Installation (NDIS 5.1)".
>> >>
>> >> In practice, I was able to install the WDK sample PassThru and our own
>> >> driver which is based on PassThru with no observable problems. Both
>> >> drivers
>> >> have their FilterClass specified as failover in their respective INF
>> >> files.
>> >>
>> >> Am I misunderstanding something here? Is the documentation making a
>> >> recommendation instead of stating policy?
>> >>
>> >>
>> >>
>>
>>