Hi I'm writing a miniport NDIS driver with a coworker offsite. He is
seeing packets arrive in two buffers (1 with eth+ip+tcp header, 1 with
data) whereas I am seeing four buffers (1 with eth, 1 with ip, 1 with
tcp, 1 with data).

I guess it's safe to assume there are no guarantees, but what determines
how the packet is broken up when it's passed to the driver?

Or is there a randomization in the tcpip stack that varies it to keep
lower drivers from making any assumptions?

Thanks -- Andy

On Apr 2, 9:06*pm, Andy Grover <andy.gro...@oracle.com> wrote:
There are no safe assumptions that you can make about the buffer
organization except that any given header will not be split across
multiple buffers.

NDIS functions like NdisGetDataBuffer (NDIS 6) can make your like a
little simpler, however. Call this appropriately to fetch a pointer
that can be safely cast to a header structure pointer.

Good luck,