NDIS 6.0 Filter Drivers

NTDEV
1

Hi, NDIS gurus. Please clarify me how this information from WDK

  1. “The driver stack can contain one instance (filter module) of a modifying filter driver and multiple instances of a monitoring filter driver.”
    is collaborating with this:
  2. “You can specify that a filter driver is mandatory. This feature is usually used with modifying filter drivers. If a mandatory filter driver fails to load, the associated driver stack will be torn down.”
    Can I think about this like: “If somebody will develop mandatory modifying filter driver and will install it, nobody can attach another mandatory modifying filter module to a driver stack”? Another words: “only one will survive”?
2

> -----Original Message-----

From: xxxxx@lists.osr.com [mailto:bounce-291825-
xxxxx@lists.osr.com] On Behalf Of xxxxx@infotecs.ru
Sent: Thursday, June 28, 2007 5:03 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] NDIS 6.0 Filter Drivers

Hi, NDIS gurus. Please clarify me how this information from WDK

  1. “The driver stack can contain one instance (filter module) of a
    modifying filter driver and multiple instances of a monitoring filter
    driver.”
    [PCAUSA] This means that if you have a modifying filter that can bind to multiple NDIS media types on a given “stack” above a lowest-level NDIS miniport, then your modifying filter will bind only once in that specific stack of filters.

There could be other modifying or monitoring filters in the same stack above a miniport.

is collaborating with this:
2. “You can specify that a filter driver is mandatory. This feature is
usually used with modifying filter drivers. If a mandatory filter
driver fails to load, the associated driver stack will be torn down.”
Can I think about this like: “If somebody will develop mandatory
modifying filter driver and will install it, nobody can attach another
mandatory modifying filter module to a driver stack”? Another words:
“only one will survive”?
[PCAUSA] No. Why should it?

Thomas F. Divine

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

3

Thanks very much, Tomas. Your information very usefull for me.
By the way, may be you know, where are “roots” of that limitation?

4

What limitation?

If there are two mandatory modifying drivers then it is certainly possible for both of them to install successfully.

Mandatory doesn’t mean “exclusive”.

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-291850-
xxxxx@lists.osr.com] On Behalf Of xxxxx@infotecs.ru
Sent: Thursday, June 28, 2007 10:06 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] NDIS 6.0 Filter Drivers

Thanks very much, Tomas. Your information very usefull for me.
By the way, may be you know, where are “roots” of that limitation?

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

5

>What limitation?
I say about “The driver stack can contain one instance (filter module) of a modifying filter driver…”.
Why only “one instance”?

6

one instance of your own driver?

----- Original Message -----
From:
To: “Windows System Software Devs Interest List”
Sent: Thursday, June 28, 2007 3:58 PM
Subject: RE:[ntdev] NDIS 6.0 Filter Drivers

> >What limitation?
> I say about “The driver stack can contain one instance (filter module) of
> a modifying filter driver…”.
> Why only “one instance”?
>
> —
> Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>

7

>one instance of your own driver?
Yes. If I understand correctly, monitoring filter driver is not have such restriction.

8

I am not on the NDIS development team, so I don’t know why they chose this strategy. However, for most cases it makes sense.

Consider a “stack” consisting of a NDIS miniport at the bottom and the NDIS protocols at the top. In most cases a modifying filter writer will want to make modifications only at one binding in this vertical stack over a given lowest-level miniport.

The same filter can have bindings over more than one lowest-level miniport (“horizontal”) but not be bound at more than one place above a single lowest-level miniport (“vertical”).

If you want to make modifications at more than one location above a single lowest-level miniport, then you need multiple modifying filters. For example, if you want to make modifications above and below the Microsoft Native Wi-Fi filter, then you would need two modifying filters: One designed to bind to Ethernet above the Native Wi-Fi filter and a second designed to bind to Native 802.11 below the Native Wi-Fi filter.

Good luck,

Thomas F. Divine

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-291855-
xxxxx@lists.osr.com] On Behalf Of xxxxx@infotecs.ru
Sent: Thursday, June 28, 2007 10:59 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] NDIS 6.0 Filter Drivers

>What limitation?
I say about “The driver stack can contain one instance (filter module)
of a modifying filter driver…”.
Why only “one instance”?

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer

9

Thanks, Tomas. Good luck to you too.

10

Right. A monitoring filter will bind above and below all modifying filters above a lowest-level miniport. An example of a monitoring filter is PCAGizmo at:

http://www.pcausa.com/Utilities/PCAGizmo/PCAGizmo.htm

Thomas F. Divine
http://www.pcausa.com

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-291857-
xxxxx@lists.osr.com] On Behalf Of xxxxx@infotecs.ru
Sent: Thursday, June 28, 2007 11:22 AM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] NDIS 6.0 Filter Drivers

>one instance of your own driver?
Yes. If I understand correctly, monitoring filter driver is not have
such restriction.

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer