Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

UpperFilter Device Object

ahura_24ahura_24 Member Posts: 4

Hi everyone.
I hope you're doing well.

I've written an UpperFilter DO for many device type preventing them from starting at "IRP_MN_START_DEVICE". According to MSDN the ClassGuid "GUID_DEVCLASS_NET" is for both Wireless and Ethernet Device/Interface, if I wasn't wrong.
So, Please let me know how I can distinguish between Wireless and Ethernet at "IRP_MN_START_DEVICE" ?
And is there any way to know any devices are "External" or "Internal" ?

Thank you so much for your help


  • MBond2MBond2 Member Posts: 460

    There is no possible way for any software to know the difference between 'internal' or 'external' devices.

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,986
    edited May 3

    There is no possible way

    You’re sure of that? You’ve tried it?

    Because I’m not so sure. Seems like you should be able to suss this out with some sort of query. But, never having done this (though I may need to soon), I passed on answering.


    Post edited by Peter_Viscarola_(OSR) on

    Peter Viscarola

  • Mark_RoddyMark_Roddy Member - All Emails Posts: 4,538

    I'm pretty sure a proper ndis filter can figure this out, but the op is limited to 'things one can query during START_DEVICE', and that is a pretty short list.

  • MBond2MBond2 Member Posts: 460

    I am very sure because I have done crazy things like building machines with external SCSI cables and internal USB devices. Hardware can report 'internal' versus 'external' status, and one can make inferences based on the bus type or other characteristics of the device, but there is no definitive test that software can make.

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,986

    external SCSI cables and internal USB devices

    Sure, that’s not so crazy at all.

    SCSI is, indeed, a good one. No telling there, for sure.

    ISTR that there’s a proxy/heuristic specifically for internal USB devices…ah, perhaps the “removable” attribute?

    Anyhow, it’s an interesting problem.

    Peter Viscarola

  • ahura_24ahura_24 Member Posts: 4
    edited May 4

    Hi again,

    Guys I was studying MSDN and I'm not sure but, Can I use "DEVICE_REMOVAL_POLICY" to determine if one device is "external" or "internal" ? For ex: "External WIFI" or "Internal LAN" ?

    Just for more information, I extract device information at "Add Device" and store them in "device extension" and at "IRP PNP | MN Start" I will match and prevent devices from starting.

    Tnx for your help and guidance

  • Peter_Viscarola_(OSR)Peter_Viscarola_(OSR) Administrator Posts: 8,986
    edited May 4

    Well, ANYthing like that is going to be an heuristic, and not necessarily definitive. So, you simply need to try it on a bunch of systems to see how accurate it is.

    In ANY case, Mr. Bond is certainly correct that there's no in-built feature in Windows that definitively tells you "this device is internal" -- And, as he so aptly demonstrated by the SCSI case, in at least some cases it's absolutely impossible to know what's IN the machine and what's NOT in the machine.


    Peter Viscarola

  • MBond2MBond2 Member Posts: 460

    It should also be noted that the newer SAS and NVMe protocols also have extensive families of internal and external hardware and thunderbolt is external PCIe.

    If you change your question, and ask is a device removable or not, then yes you can get an answer. Understanding of course that some external devices are not marked as removable and some internal devices are.

    On a test machine that I have, Windows boots from an external drive, but the CPU is marked as removable.

  • ahura_24ahura_24 Member Posts: 4
    edited May 5

    Thank everyone for help.

    @MBond2 , About "removable device", Do you mean "IOCTL_STORAGE_QUERY_PROPERTY"? And does it only work for "Storage Devices" such as "USB Flash Memory" ? Could you give me a little more information please?

    About my first question, "Distinguish between wireless or ethernet", Do you think there is any way for me to distinguish them here?

    Only for more information: I found all parents of device and queried "IRP_MN_QUERY_BUS_INFORMATION" but unfortunately it didn't work and some devices didn't handle this query.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Writing WDF Drivers 12 September 2022 Live, Online
Internals & Software Drivers 23 October 2022 Live, Online
Kernel Debugging 14 November 2022 Live, Online
Developing Minifilters 5 December 2022 Live, Online