Main Page   Modules   Data Structures   File List   Data Fields   Globals   Related Pages  

dump.c File Reference

#include <stdarg.h>
#include <ntddk.h>
#include <ntiologc.h>
#include <ndis.h>
#include "debug.h"
#include "packet.h"
#include "win_bpf.h"

Go to the source code of this file.

Functions

NTSTATUS NPF_OpenDumpFile (POPEN_INSTANCE Open, PUNICODE_STRING fileName, BOOLEAN Append)
 Creates the file that will receive the packets when the driver is in dump mode.

NTSTATUS NPF_StartDump (POPEN_INSTANCE Open)
 Starts dump to file.

VOID NPF_DumpThread (POPEN_INSTANCE Open)
NTSTATUS NPF_SaveCurrentBuffer (POPEN_INSTANCE Open)
 Saves the content of the packet buffer to the file associated with current instance.

NTSTATUS NPF_CloseDumpFile (POPEN_INSTANCE Open)
 Closes the dump file associated with an instance of the driver.

NTSTATUS PacketDumpCompletion (PDEVICE_OBJECT DeviceObject, PIRP Irp, PVOID Context)
VOID NPF_WriteDumpFile (PFILE_OBJECT FileObject, PLARGE_INTEGER Offset, ULONG Length, PMDL Mdl, PIO_STATUS_BLOCK IoStatusBlock)
 Writes a block of packets on the dump file.


Function Documentation

NTSTATUS NPF_CloseDumpFile POPEN_INSTANCE    Open
 

Closes the dump file associated with an instance of the driver.

Parameters:
Open The NPF instance that closes the file.
Returns:
The status of the operation. See ntstatus.h in the DDK.

Definition at line 470 of file dump.c.

References _OPEN_INSTANCE::DumpFileHandle, _OPEN_INSTANCE::DumpFileName, _OPEN_INSTANCE::DumpFileObject, _OPEN_INSTANCE::DumpOffset, NPF_OpenDumpFile(), and NPF_SaveCurrentBuffer().

Referenced by NPF_Close(), NPF_IoControl(), and NPF_UnbindAdapter().

VOID NPF_DumpThread POPEN_INSTANCE    Open
 

Definition at line 274 of file dump.c.

References _OPEN_INSTANCE::DumpEvent, _OPEN_INSTANCE::DumpLimitReached, _OPEN_INSTANCE::DumpOffset, NPF_SaveCurrentBuffer(), and _OPEN_INSTANCE::Size.

NTSTATUS NPF_OpenDumpFile POPEN_INSTANCE    Open,
PUNICODE_STRING    fileName,
BOOLEAN    append
 

Creates the file that will receive the packets when the driver is in dump mode.

Parameters:
Open The NPF instance that opens the file.
fileName Pointer to a UNICODE string containing the name of the file.
append Boolean value that specifies if the data must be appended to the file.
Returns:
The status of the operation. See ntstatus.h in the DDK.

Definition at line 45 of file dump.c.

References _OPEN_INSTANCE::DumpFileHandle, and _OPEN_INSTANCE::DumpFileObject.

Referenced by NPF_CloseDumpFile(), and NPF_IoControl().

NTSTATUS NPF_SaveCurrentBuffer POPEN_INSTANCE    Open
 

Saves the content of the packet buffer to the file associated with current instance.

Parameters:
Open The NPF instance that creates the thread.
Used by NPF_DumpThread() and NPF_CloseDumpFile().

Definition at line 312 of file dump.c.

References _OPEN_INSTANCE::DumpFileObject, _OPEN_INSTANCE::DumpLimitReached, _OPEN_INSTANCE::DumpOffset, _OPEN_INSTANCE::MaxDumpBytes, NPF_WriteDumpFile(), and _OPEN_INSTANCE::ReadEvent.

Referenced by NPF_CloseDumpFile(), and NPF_DumpThread().

NTSTATUS NPF_StartDump POPEN_INSTANCE    Open
 

Starts dump to file.

Parameters:
Open The NPF instance that opens the file.
Returns:
The status of the operation. See ntstatus.h in the DDK.
This function performs two operations. First, it writes the libpcap header at the beginning of the file. Second, it starts the thread that asynchronously dumps the network data to the file.

Definition at line 153 of file dump.c.

References _OPEN_INSTANCE::DumpFileHandle, _OPEN_INSTANCE::DumpFileObject, _OPEN_INSTANCE::DumpOffset, _OPEN_INSTANCE::DumpThreadHandle, _OPEN_INSTANCE::DumpThreadObject, packet_file_header::linktype, packet_file_header::magic, _OPEN_INSTANCE::Medium, PCAP_VERSION_MAJOR, PCAP_VERSION_MINOR, packet_file_header::sigfigs, packet_file_header::snaplen, TCPDUMP_MAGIC, packet_file_header::thiszone, packet_file_header::version_major, and packet_file_header::version_minor.

Referenced by NPF_IoControl().

VOID NPF_WriteDumpFile PFILE_OBJECT    FileObject,
PLARGE_INTEGER    Offset,
ULONG    Length,
PMDL    Mdl,
PIO_STATUS_BLOCK    IoStatusBlock
 

Writes a block of packets on the dump file.

Parameters:
FileObject The file object that will receive the packets.
Offset The offset in the file where the packets will be put.
Length The amount of bytes to write.
Mdl MDL mapping the memory buffer that will be written to disk.
IoStatusBlock Used by the function to return the status of the operation.
Returns:
The status of the operation. See ntstatus.h in the DDK.
NPF_WriteDumpFile addresses directly the file system, creating a custom IRP and using it to send a portion of the NPF circular buffer to disk. This function is used by NPF_DumpThread().

Definition at line 531 of file dump.c.

Referenced by NPF_SaveCurrentBuffer().

NTSTATUS PacketDumpCompletion PDEVICE_OBJECT    DeviceObject,
PIRP    Irp,
PVOID    Context
[static]
 

Definition at line 515 of file dump.c.


documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.