Attaching an NDIS LWF to a Virtual Adapter with a nolower LowerRange?

NTDEV
1

Hi,

We have an NDIS LWF, and recently we noticed that some Virtual Adapters (mostly VPNs, such as KerioControl VPN client) have Ndi\Interfaces,LowerRange,,"nolower" In their INF, therefore causing us to not attach to them because we didn’t have nolower in our FilterMediaTypes inside our INF.

So we thought surely adding nolower to FilterMediaTypes will make us attach to these virtual adapters, but the results were interesting:

On Windows 7 machines, adding nolower to the FilterMediaTypes worked just fine and we attached to it, but the weird part is that on Windows 10+ machines, adding nolower to FilterMediaTypes has no effect! And the only way to attach to these virtual adapters in Windows 10 is to add ndis5 to our ndi\Interfaces,LowerRange , which previously only had nolower in it.

So my questions are:

  1. Why is it that on windows 10 machines we have to add ndis5 to our LowerRange and adding nolower to FilterMediaTypes has no effect, unlike windows 7? Is this a bug or intended?

  2. Is it safe to do this? Meaning adding ndis5 to our LowerRange (for windows 10+) and adding nolower to our FilterMediaTypes (for windows 7)?

  3. If its not safe, then what are the side effects? For example is there any possibility of BSOD? And then what is the optimal solution then in order to attach to these virtual adapters? (Other than asking their vendor to change their INF)