Hello!

I'm programming a ndis filter driver that handles 802.3 media
(Ethernet II frames). I am looking for info how ethernet frames are
put into buffers. Does every single NET_BUFFER contain one frame? Or
does every NET_BUFFER_LIST contain one ethernet frame (fragmented in
NET_BUFFERS)? Last there is the option that the frames are not split
at all. The documentation has no info on this subject (or I just
haven't been able to find any)

Thank you for your attention!

Sh0

"Sh0" <zimdynee@hot.ee> wrote in message
news:1187361377.237197.66460@19g2000hsx.googlegrou ps.com...
organized in either NDIS_PACKET (NDIS 5.X) or NET_BUFFER (NDIS6). If you
make too many assumptions you will get a surprise.

Some reasonable assumptions are that:

1.) The MAC header will be in contiguous memory in the first MDL.
2.) The IP header will be in contiguous memory - but not necessarily in the
first MDL.
3.) The TCP or UDP header will be in contiguous memory - but not necessarily
in the same MDL.

Actually, one of the best places to discuss this topic is the MSDN Forum for
the "Windows Filtering Platform". Also, see the online WFP documentation; it
may be more up-to-date than the offline WFP documentation.

Good luck,

Thomas F. Divine
http://www.pcausa.com