Question on NET_BUFFER_LISTS and protocol.

As far as I can figure out NET_BUFFER will always give me the entire packet including the layer 2 headers (ethernet , wifi , etc …). Is there some robust way to get where the IP header starts inside the NET_BUFFER and not rely on parsing the frames based on NDIS_MEDIUM (or maybe even that is not a feasible way)?
Also, can I make any assumptions about NET_BUFFERs that are within the same list or same chain of lists like, for example them being of the same protocol ?
I mean I know I can get NdisGetNetBufferListProtocolId and it will say that a list is all TCP, but it does not say weather it’s all IPv4 or all IPv6, also does not say anything about the other lists in the chain.

See, below have some relevant info on NBL
https://community.osr.com/discussion/262465
https://community.osr.com/discussion/291165/ndisimplatformbindingoptions-and-lwfs

1 Like

Thank you very much, this has cleared up alot of things for me!