I have an NDIS IM filter driver that tries to keep track of WAN interfaces
via the StatusHandler member of the NDIS_PROTOCOL_CHARACTERISTICS struct
passed to NdisRegisterProtocol(). When receiving a NDIS_WAN_LINE_UP
notification I scan through my list of existing WAN interfaces, using the
LocalAddress and RemoteAddress in the NDIS_WAN_LINE_UP structure to
perform the lookup. If no matching interfaces are found, a new interface
is added. When receiving a NDIS_WAN_LINE_DOWN notification I delete my
corresponding interface.

When doing a test with a dialup modem and cycling through a few connect

  • disconnect cycles I noticed that the behaviour on Windows XP SP2 is
    substantially different from that on 2000 and XP SP1. Upon disconnecting
    the modem I receive a NDIS_WAN_LINE_UP notification that contains
    different LocalAddress and RemoteAddress values followed by a matching
    (based on LocalAddress and RemoteAddress) NDIS_WAN_LINE_DOWN notification.
    I never see a NDIS_WAN_LINE_DOWN notification for the original
    NDIS_WAN_LINE_UP notification. Needless to say this breaks my feeble
    attempt at tracking WAN interfaces. Does anyone have any pointers for me
    as to what is going on here?