can't see TDI_SEND_DATAGRAM called

HI.... I'm analyzind a TDI filter.... I like to trace the calls going
through the filter and functions that gets called... to do so I have simple
client/server TCP and UDP apps... when Testing the TCP app I can see that
TDI_CONNECT and TDI_SEND gets called in the InternalDispatchTable....
However when Testing the UDP app I can't see the TDI_SEND_DATAGRAM called
(though app is working)..... However when Windows Services.exe runs (in the
background) TDI_SEMD_DATAGRAM is called..... why is that??????????
1. does this depends on how exactly the upper layer application makes the
socket/send call????
2. How many different ways do we have to make that call??
3. What exactly is the difference between FsContext and FsContext2 fileds
are in the File Object????
4. The EventType filed in PTDI_REQUEST_KERNEL_SET_EVENT structure returns 2
and 10... what exactly are they??

would very much appreciate your feedback.

Steve
Wed Jan 12 18:07:28 CST 2005

1. does this depends on how exactly the upper layer
application makes the
socket/send call????
...
Probably! How are you viewing these events? Breakpoints
in the code? TDIMon? Are you confident your are seeing
all the events?


2. How many different ways do we have to make that call??
...
As well as TDI_SEND_DATAGRAM, the client can send a
TDI_RECEIVE_DATAGRAM command to ask the remote node for a
datagram, or the client can register a receive datagram
event handler which will allow it to receive inbound
datagrams.


3. What exactly is the difference between FsContext and
FsContext2 fileds are in the File Object????
...
These fields are used by the tdi client (sockets, etc.)
and probably only have meaning to the client.

4. The EventType filed in PTDI_REQUEST_KERNEL_SET_EVENT
structure returns 2 and 10... what exactly are they??
...
EventType is the event you want to capture/register an
event handler for. The different event types are defined
in tdikrnl.h ... 2 = TDI_EVENT_ERROR, 10 =
TDI_EVENT_ERROR_EX.


>-----Original Message-----
>HI.... I'm analyzind a TDI filter.... I like to trace
the calls going
>through the filter and functions that gets called... to
do so I have simple
>client/server TCP and UDP apps... when Testing the TCP
app I can see that
>TDI_CONNECT and TDI_SEND gets called in the
InternalDispatchTable....
>However when Testing the UDP app I can't see the
TDI_SEND_DATAGRAM called
>(though app is working)..... However when Windows
Services.exe runs (in the
>background) TDI_SEMD_DATAGRAM is called..... why is
that??????????
>1. does this depends on how exactly the upper layer
application makes the
>socket/send call????
>2. How many different ways do we have to make that
call??
>3. What exactly is the difference between FsContext and
FsContext2 fileds
>are in the File Object????
>4. The EventType filed in PTDI_REQUEST_KERNEL_SET_EVENT
structure returns 2
>and 10... what exactly are they??
>
>would very much appreciate your feedback.
>
>
>.
>

Sandra
Thu Jan 13 11:50:26 CST 2005

Thanks for your response...
> Probably! How are you viewing these events? Breakpoints
> in the code? TDIMon? Are you confident your are seeing
> all the events?
I'm using kernel mode debugger (dbgview) and I'm pretty sure seeing all the
events... is it possible that dbgview doesn't show all the events?? but then
again I see TDI_SEND_DATAGRAM called when windows services.exe runs
(automatically in the background)

> As well as TDI_SEND_DATAGRAM, the client can send a
> TDI_RECEIVE_DATAGRAM command to ask the remote node for a
> datagram, or the client can register a receive datagram
> event handler which will allow it to receive inbound
> datagrams.

I guess the question is how does e.g. send(), sendto(), sockStream() and
other forms of socket call translates to different TDI socket calls??

thanks
"Steve Woodberry" <swoodberry@foursticks.com> wrote in message
news:040101c4f903$de2807c0$a301280a@phx.gbl...
> 1. does this depends on how exactly the upper layer
> application makes the
> socket/send call????
> ...
> Probably! How are you viewing these events? Breakpoints
> in the code? TDIMon? Are you confident your are seeing
> all the events?
>
>
> 2. How many different ways do we have to make that call??
> ...
> As well as TDI_SEND_DATAGRAM, the client can send a
> TDI_RECEIVE_DATAGRAM command to ask the remote node for a
> datagram, or the client can register a receive datagram
> event handler which will allow it to receive inbound
> datagrams.
>
>
> 3. What exactly is the difference between FsContext and
> FsContext2 fileds are in the File Object????
> ...
> These fields are used by the tdi client (sockets, etc.)
> and probably only have meaning to the client.
>
> 4. The EventType filed in PTDI_REQUEST_KERNEL_SET_EVENT
> structure returns 2 and 10... what exactly are they??
> ...
> EventType is the event you want to capture/register an
> event handler for. The different event types are defined
> in tdikrnl.h ... 2 = TDI_EVENT_ERROR, 10 =
> TDI_EVENT_ERROR_EX.
>
>
> >-----Original Message-----
> >HI.... I'm analyzind a TDI filter.... I like to trace
> the calls going
> >through the filter and functions that gets called... to
> do so I have simple
> >client/server TCP and UDP apps... when Testing the TCP
> app I can see that
> >TDI_CONNECT and TDI_SEND gets called in the
> InternalDispatchTable....
> >However when Testing the UDP app I can't see the
> TDI_SEND_DATAGRAM called
> >(though app is working)..... However when Windows
> Services.exe runs (in the
> >background) TDI_SEMD_DATAGRAM is called..... why is
> that??????????
> >1. does this depends on how exactly the upper layer
> application makes the
> >socket/send call????
> >2. How many different ways do we have to make that
> call??
> >3. What exactly is the difference between FsContext and
> FsContext2 fileds
> >are in the File Object????
> >4. The EventType filed in PTDI_REQUEST_KERNEL_SET_EVENT
> structure returns 2
> >and 10... what exactly are they??
> >
> >would very much appreciate your feedback.
> >
> >
> >.
> >

Maxim
Thu Jan 13 13:22:52 CST 2005

> I guess the question is how does e.g. send(), sendto(), sockStream() and
> other forms of socket call translates to different TDI socket calls??

listen() installs a ClientEvent handler. On each handler call, it takes the
socket embryon, completes it and fires its completion routine, which puts it to
another queue.

accept() consumes this "another queue".

Now on send(). It copies the data to the kernel temporary buffer and does
TDI_SEND on this buffer. It also maintains the overall size of such temporary
buffers - incremeneted on data copy, decremented on buffer destruction in
TDI_SEND completion. If this size is >= SO_SNDBUF - then the next send() will
be directly TDI_SEND, without any additional buffers.

So, with SO_SNDBUF == 0, any send() == TDI_SEND. The good side: one less
memcpy(). The bad side: TDI_SEND completes only when all ACKs have arrived for
this chunk, and TCP needs it no more (TCP does no buffering inside itself). So,
be careful with size of your sends if you have SO_SNDBUF == 0.

All of the above is AFD.SYS internals.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Steve
Thu Jan 13 19:20:15 CST 2005

DbgView will display anything that you have DbgPrint()
calls for in your code! You should download a copy of
TDImon from www.sysinternals.com - it is pretty useful.
If you are doing a lot of device driver work you should
invest in a copy of softice - this will let you step
through your kernel mode code.

Steve.

>-----Original Message-----
>Thanks for your response...
>> Probably! How are you viewing these events?
Breakpoints
>> in the code? TDIMon? Are you confident your are seeing
>> all the events?
>I'm using kernel mode debugger (dbgview) and I'm pretty
sure seeing all the
>events... is it possible that dbgview doesn't show all
the events?? but then
>again I see TDI_SEND_DATAGRAM called when windows
services.exe runs
>(automatically in the background)
>
>> As well as TDI_SEND_DATAGRAM, the client can send a
>> TDI_RECEIVE_DATAGRAM command to ask the remote node
for a
>> datagram, or the client can register a receive datagram
>> event handler which will allow it to receive inbound
>> datagrams.
>
>I guess the question is how does e.g. send(), sendto(),
sockStream() and
>other forms of socket call translates to different TDI
socket calls??
>
>thanks
>"Steve Woodberry" <swoodberry@foursticks.com> wrote in
message
>news:040101c4f903$de2807c0$a301280a@phx.gbl...
>> 1. does this depends on how exactly the upper layer
>> application makes the
>> socket/send call????
>> ...
>> Probably! How are you viewing these events?
Breakpoints
>> in the code? TDIMon? Are you confident your are seeing
>> all the events?
>>
>>
>> 2. How many different ways do we have to make that
call??
>> ...
>> As well as TDI_SEND_DATAGRAM, the client can send a
>> TDI_RECEIVE_DATAGRAM command to ask the remote node
for a
>> datagram, or the client can register a receive datagram
>> event handler which will allow it to receive inbound
>> datagrams.
>>
>>
>> 3. What exactly is the difference between FsContext and
>> FsContext2 fileds are in the File Object????
>> ...
>> These fields are used by the tdi client (sockets, etc.)
>> and probably only have meaning to the client.
>>
>> 4. The EventType filed in
PTDI_REQUEST_KERNEL_SET_EVENT
>> structure returns 2 and 10... what exactly are they??
>> ...
>> EventType is the event you want to capture/register an
>> event handler for. The different event types are
defined
>> in tdikrnl.h ... 2 = TDI_EVENT_ERROR, 10 =
>> TDI_EVENT_ERROR_EX.
>>
>>
>> >-----Original Message-----
>> >HI.... I'm analyzind a TDI filter.... I like to trace
>> the calls going
>> >through the filter and functions that gets called...
to
>> do so I have simple
>> >client/server TCP and UDP apps... when Testing the TCP
>> app I can see that
>> >TDI_CONNECT and TDI_SEND gets called in the
>> InternalDispatchTable....
>> >However when Testing the UDP app I can't see the
>> TDI_SEND_DATAGRAM called
>> >(though app is working)..... However when Windows
>> Services.exe runs (in the
>> >background) TDI_SEMD_DATAGRAM is called..... why is
>> that??????????
>> >1. does this depends on how exactly the upper layer
>> application makes the
>> >socket/send call????
>> >2. How many different ways do we have to make that
>> call??
>> >3. What exactly is the difference between FsContext
and
>> FsContext2 fileds
>> >are in the File Object????
>> >4. The EventType filed in
PTDI_REQUEST_KERNEL_SET_EVENT
>> structure returns 2
>> >and 10... what exactly are they??
>> >
>> >would very much appreciate your feedback.
>> >
>> >
>> >.
>> >
>
>
>.
>

Sandra
Mon Jan 17 17:10:19 CST 2005

Just out of curiosity, where have you read all these info from?? you know
these things so well and detailed... wow...
> this chunk, and TCP needs it no more (TCP does no buffering inside
itself). So,
> be careful with size of your sends if you have SO_SNDBUF == 0.

So if I underestand it correctly then if SO_SNDBUF == 0 then a send() from
app will translate to a TDI_SEND() from AFD.sys to a lower layer? and if it
is >0 then a
send() from app will translate to WAHT exactly??? or what does happend
exactly???

"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:%23NbAvUa%23EHA.2600@TK2MSFTNGP09.phx.gbl...
> > I guess the question is how does e.g. send(), sendto(), sockStream() and
> > other forms of socket call translates to different TDI socket calls??
>
> listen() installs a ClientEvent handler. On each handler call, it takes
the
> socket embryon, completes it and fires its completion routine, which puts
it to
> another queue.
>
> accept() consumes this "another queue".
>
> Now on send(). It copies the data to the kernel temporary buffer and does
> TDI_SEND on this buffer. It also maintains the overall size of such
temporary
> buffers - incremeneted on data copy, decremented on buffer destruction in
> TDI_SEND completion. If this size is >= SO_SNDBUF - then the next send()
will
> be directly TDI_SEND, without any additional buffers.
>
> So, with SO_SNDBUF == 0, any send() == TDI_SEND. The good side: one less
> memcpy(). The bad side: TDI_SEND completes only when all ACKs have arrived
for
> this chunk, and TCP needs it no more (TCP does no buffering inside
itself). So,
> be careful with size of your sends if you have SO_SNDBUF == 0.
>
> All of the above is AFD.SYS internals.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
>

Sandra
Mon Jan 17 17:13:47 CST 2005

thanks for the info... I will look at installing TDIMon... I did play around
Softice a bit... but.. found it too difficult to use.. at least for now:)

"Steve Woodberry" <swoodberry@foursticks.com> wrote in message
news:149801c4f9d7$33890880$a601280a@phx.gbl...
> DbgView will display anything that you have DbgPrint()
> calls for in your code! You should download a copy of
> TDImon from www.sysinternals.com - it is pretty useful.
> If you are doing a lot of device driver work you should
> invest in a copy of softice - this will let you step
> through your kernel mode code.
>
> Steve.
>
> >-----Original Message-----
> >Thanks for your response...
> >> Probably! How are you viewing these events?
> Breakpoints
> >> in the code? TDIMon? Are you confident your are seeing
> >> all the events?
> >I'm using kernel mode debugger (dbgview) and I'm pretty
> sure seeing all the
> >events... is it possible that dbgview doesn't show all
> the events?? but then
> >again I see TDI_SEND_DATAGRAM called when windows
> services.exe runs
> >(automatically in the background)
> >
> >> As well as TDI_SEND_DATAGRAM, the client can send a
> >> TDI_RECEIVE_DATAGRAM command to ask the remote node
> for a
> >> datagram, or the client can register a receive datagram
> >> event handler which will allow it to receive inbound
> >> datagrams.
> >
> >I guess the question is how does e.g. send(), sendto(),
> sockStream() and
> >other forms of socket call translates to different TDI
> socket calls??
> >
> >thanks
> >"Steve Woodberry" <swoodberry@foursticks.com> wrote in
> message
> >news:040101c4f903$de2807c0$a301280a@phx.gbl...
> >> 1. does this depends on how exactly the upper layer
> >> application makes the
> >> socket/send call????
> >> ...
> >> Probably! How are you viewing these events?
> Breakpoints
> >> in the code? TDIMon? Are you confident your are seeing
> >> all the events?
> >>
> >>
> >> 2. How many different ways do we have to make that
> call??
> >> ...
> >> As well as TDI_SEND_DATAGRAM, the client can send a
> >> TDI_RECEIVE_DATAGRAM command to ask the remote node
> for a
> >> datagram, or the client can register a receive datagram
> >> event handler which will allow it to receive inbound
> >> datagrams.
> >>
> >>
> >> 3. What exactly is the difference between FsContext and
> >> FsContext2 fileds are in the File Object????
> >> ...
> >> These fields are used by the tdi client (sockets, etc.)
> >> and probably only have meaning to the client.
> >>
> >> 4. The EventType filed in
> PTDI_REQUEST_KERNEL_SET_EVENT
> >> structure returns 2 and 10... what exactly are they??
> >> ...
> >> EventType is the event you want to capture/register an
> >> event handler for. The different event types are
> defined
> >> in tdikrnl.h ... 2 = TDI_EVENT_ERROR, 10 =
> >> TDI_EVENT_ERROR_EX.
> >>
> >>
> >> >-----Original Message-----
> >> >HI.... I'm analyzind a TDI filter.... I like to trace
> >> the calls going
> >> >through the filter and functions that gets called...
> to
> >> do so I have simple
> >> >client/server TCP and UDP apps... when Testing the TCP
> >> app I can see that
> >> >TDI_CONNECT and TDI_SEND gets called in the
> >> InternalDispatchTable....
> >> >However when Testing the UDP app I can't see the
> >> TDI_SEND_DATAGRAM called
> >> >(though app is working)..... However when Windows
> >> Services.exe runs (in the
> >> >background) TDI_SEMD_DATAGRAM is called..... why is
> >> that??????????
> >> >1. does this depends on how exactly the upper layer
> >> application makes the
> >> >socket/send call????
> >> >2. How many different ways do we have to make that
> >> call??
> >> >3. What exactly is the difference between FsContext
> and
> >> FsContext2 fileds
> >> >are in the File Object????
> >> >4. The EventType filed in
> PTDI_REQUEST_KERNEL_SET_EVENT
> >> structure returns 2
> >> >and 10... what exactly are they??
> >> >
> >> >would very much appreciate your feedback.
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >

Arkady
Tue Jan 18 03:15:42 CST 2005

It's very easy to use , but expensive :)
Arkady

"Sandra" <sandra@noemailplease.com> wrote in message
news:u9VlPmO$EHA.3592@TK2MSFTNGP09.phx.gbl...
> thanks for the info... I will look at installing TDIMon... I did play
around
> Softice a bit... but.. found it too difficult to use.. at least for now:)
>
> "Steve Woodberry" <swoodberry@foursticks.com> wrote in message
> news:149801c4f9d7$33890880$a601280a@phx.gbl...
> > DbgView will display anything that you have DbgPrint()
> > calls for in your code! You should download a copy of
> > TDImon from www.sysinternals.com - it is pretty useful.
> > If you are doing a lot of device driver work you should
> > invest in a copy of softice - this will let you step
> > through your kernel mode code.
> >
> > Steve.
> >
> > >-----Original Message-----
> > >Thanks for your response...
> > >> Probably! How are you viewing these events?
> > Breakpoints
> > >> in the code? TDIMon? Are you confident your are seeing
> > >> all the events?
> > >I'm using kernel mode debugger (dbgview) and I'm pretty
> > sure seeing all the
> > >events... is it possible that dbgview doesn't show all
> > the events?? but then
> > >again I see TDI_SEND_DATAGRAM called when windows
> > services.exe runs
> > >(automatically in the background)
> > >
> > >> As well as TDI_SEND_DATAGRAM, the client can send a
> > >> TDI_RECEIVE_DATAGRAM command to ask the remote node
> > for a
> > >> datagram, or the client can register a receive datagram
> > >> event handler which will allow it to receive inbound
> > >> datagrams.
> > >
> > >I guess the question is how does e.g. send(), sendto(),
> > sockStream() and
> > >other forms of socket call translates to different TDI
> > socket calls??
> > >
> > >thanks
> > >"Steve Woodberry" <swoodberry@foursticks.com> wrote in
> > message
> > >news:040101c4f903$de2807c0$a301280a@phx.gbl...
> > >> 1. does this depends on how exactly the upper layer
> > >> application makes the
> > >> socket/send call????
> > >> ...
> > >> Probably! How are you viewing these events?
> > Breakpoints
> > >> in the code? TDIMon? Are you confident your are seeing
> > >> all the events?
> > >>
> > >>
> > >> 2. How many different ways do we have to make that
> > call??
> > >> ...
> > >> As well as TDI_SEND_DATAGRAM, the client can send a
> > >> TDI_RECEIVE_DATAGRAM command to ask the remote node
> > for a
> > >> datagram, or the client can register a receive datagram
> > >> event handler which will allow it to receive inbound
> > >> datagrams.
> > >>
> > >>
> > >> 3. What exactly is the difference between FsContext and
> > >> FsContext2 fileds are in the File Object????
> > >> ...
> > >> These fields are used by the tdi client (sockets, etc.)
> > >> and probably only have meaning to the client.
> > >>
> > >> 4. The EventType filed in
> > PTDI_REQUEST_KERNEL_SET_EVENT
> > >> structure returns 2 and 10... what exactly are they??
> > >> ...
> > >> EventType is the event you want to capture/register an
> > >> event handler for. The different event types are
> > defined
> > >> in tdikrnl.h ... 2 = TDI_EVENT_ERROR, 10 =
> > >> TDI_EVENT_ERROR_EX.
> > >>
> > >>
> > >> >-----Original Message-----
> > >> >HI.... I'm analyzind a TDI filter.... I like to trace
> > >> the calls going
> > >> >through the filter and functions that gets called...
> > to
> > >> do so I have simple
> > >> >client/server TCP and UDP apps... when Testing the TCP
> > >> app I can see that
> > >> >TDI_CONNECT and TDI_SEND gets called in the
> > >> InternalDispatchTable....
> > >> >However when Testing the UDP app I can't see the
> > >> TDI_SEND_DATAGRAM called
> > >> >(though app is working)..... However when Windows
> > >> Services.exe runs (in the
> > >> >background) TDI_SEMD_DATAGRAM is called..... why is
> > >> that??????????
> > >> >1. does this depends on how exactly the upper layer
> > >> application makes the
> > >> >socket/send call????
> > >> >2. How many different ways do we have to make that
> > >> call??
> > >> >3. What exactly is the difference between FsContext
> > and
> > >> FsContext2 fileds
> > >> >are in the File Object????
> > >> >4. The EventType filed in
> > PTDI_REQUEST_KERNEL_SET_EVENT
> > >> structure returns 2
> > >> >and 10... what exactly are they??
> > >> >
> > >> >would very much appreciate your feedback.
> > >> >
> > >> >
> > >> >.
> > >> >
> > >
> > >
> > >.
> > >
>
>

Maxim
Tue Jan 18 05:28:19 CST 2005

> So if I underestand it correctly then if SO_SNDBUF == 0 then a send() from
> app will translate to a TDI_SEND() from AFD.sys to a lower layer?

Exactly. By an IRP stack location reuse IIRC.

> is >0 then a
> send() from app will translate to WAHT exactly???

Allocate a temp buffer, copy the data there, TDI_SEND of it, complete send().

The completion of TDI_SEND will free the temp buffer.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

Sandra
Tue Jan 18 10:49:08 CST 2005

ok.. got it... thank you...
"Maxim S. Shatskih" <maxim@storagecraft.com> wrote in message
news:%23ZHzwCV$EHA.3908@TK2MSFTNGP12.phx.gbl...
> > So if I underestand it correctly then if SO_SNDBUF == 0 then a send()
from
> > app will translate to a TDI_SEND() from AFD.sys to a lower layer?
>
> Exactly. By an IRP stack location reuse IIRC.
>
> > is >0 then a
> > send() from app will translate to WAHT exactly???
>
> Allocate a temp buffer, copy the data there, TDI_SEND of it, complete
send().
>
> The completion of TDI_SEND will free the temp buffer.
>
> --
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> maxim@storagecraft.com
> http://www.storagecraft.com
>
>