A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #22963  by Marc1
 Thu May 22, 2014 3:34 pm
Hi,
I'm currently working on a network driver which is supposed to directly
communicate with TDI driver through \device\tcp device.

I'm correctly sending the TCP request by building TDI_SEND irp and I've
registered a ClientEventReceive handler which is receiving the reply from a web
server.

Everything is working properly, both sending and receiving, though I'm stuck on
a very common issue that I'm not able to get rid off of.

After I sent out a GET request to the web server I start receiving a series of
TSDU messages (not fragmented, everything is fine). Quite often I don't receive
a single TSDU, I receive a number of TSDU packets.

The issue raises here: I don't know exactly what is the ending TSDU packet and
between the last TSDU and the ClientEventDisconnect happens a timeout of around
3 seconds - which is not acceptable wait.

Do you have any hint how I'm supposed to understand which is the TSDU packet
that is ending the series of TSDU packets so that I know the receive even is
ended and I don't have to wait that 3 seconds timeout?

Thanks!