RtPacketLogger

Description

RtPacketLogger is a simple filter driver that logs every packet it sees to a file in a standard format that is readable by utilities such as Wireshark (http://www.wireshark.org) and Microsoft Network Monitor (http://support.microsoft.com/kb/933741/en-us). RtPacketLogger is hard-coded to log its data to C:\\RtPacketLog.cap.

Source Files

RtPacketLogger project source files:

RtPacketLogger.c contains the DllMain for the RtPacketLogger RtDLL functions.
RtPacketLoggerFuncs.c contains the following functions:

RtOpenPacketLog is called when the driver is going up to open the packet log for tracing.
RtClosePacketLog is called when the driver is going down to close the packet log.
RtWritePacketLog is called for sent and received traffic.
RtndReceiveFilter reads the frame & determines if it will be sent or dropped.
RtndTransmitFilter is called when the stack wants to transmit a frame.
RtndUpDownFilter is called when the stack requires that the driver start (or stop) a particular NIC card.
RtndIoctlFilter is called when the stack requires that the driver configure certain NIC modes or characteristics.
RtndConfigurationFilter is called for each instance of the driver when the driver should configure the NIC hardware.

Remarks

The RtClientFilter library can be built as a Win32 DLL or an RtDLL.

APIs Referenced

RTAPI

Win32 APIs

Real Time Network APIs