- PMDL BufferMdl; ///< Pointer to a Memory descriptor list (MDL) that maps the circular buffer's memory.
- PKEVENT ReadEvent; ///< Pointer to the event on which the read calls on this instance must wait.
- HANDLE ReadEventHandle; ///< Handle of the event on which the read calls on this instance must wait.
- UNICODE_STRING ReadEventName; ///< Name of the event on which the read calls on this instance must wait.
- ///< The event is created with a name, so it can be used at user level to know when it
- ///< is possible to access the driver without being blocked. This fiels stores the name
- ///< that and is used by the BIOCGEVNAME IOCTL call.
- INT Received; ///< Number of packets received by current instance from its opening, i.e. number of
- ///< packet received by the network adapter since the beginning of the
- ///< capture/monitoring/dump session.
- INT Dropped; ///< Number of packet that current instance had to drop, from its opening. A packet
- ///< is dropped if there is no more space to store it in the circular buffer that the
- ///< driver associates to current instance.
- INT Accepted; ///< Number of packet that current capture instance acepted, from its opening. A packet
- ///< is accepted if it passes the filter and fits in the buffer. Accepted packets are the
- ///< ones that reach the application.
- PUCHAR bpfprogram; ///< Pointer to the filtering pseudo-code associated with current instance of the driver.
- ///< This code is used only in particular situations (for example when the packet received
- ///< from the NIC driver is stored in two non-consecutive buffers. In normal situations
- ///< the filtering routine created by the JIT compiler and pointed by the next field
- ///< is used. See \ref NPF for details on the filtering process.
- JIT_BPF_Filter *Filter; ///< Pointer to the native filtering function created by the jitter.
- ///< See BPF_jitter() for details.
- PUCHAR Buffer; ///< Pointer to the circular buffer associated with every driver instance. It contains the
- ///< data that will be passed to the application. See \ref NPF for details.
- UINT Bhead; ///< Head of the circular buffer.
- UINT Btail; ///< Tail of the circular buffer.
- UINT BufSize; ///< Size of the circular buffer.
- UINT BLastByte; ///< Position of the last valid byte in the circular buffer.
- PMDL TransferMdl; ///< MDL used to map the portion of the buffer that will contain an incoming packet.
- ///< Used by NdisTransferData().
- NDIS_SPIN_LOCK BufLock; ///< SpinLock that protects the access tho the circular buffer variables.
- UINT MinToCopy; ///< Minimum amount of data in the circular buffer that unlocks a read. Set with the
- ///< BIOCSMINTOCOPY IOCTL.
- LARGE_INTEGER TimeOut; ///< Timeout after which a read is released, also if the amount of data in the buffer is
- ///< less than MinToCopy. Set with the BIOCSRTIMEOUT IOCTL.
-
- int mode; ///< Working mode of the driver. See PacketSetMode() for details.
- LARGE_INTEGER Nbytes; ///< Amount of bytes accepted by the filter when this instance is in statistical mode.
- LARGE_INTEGER Npackets; ///< Number of packets accepted by the filter when this instance is in statistical mode.
- NDIS_SPIN_LOCK CountersLock; ///< SpinLock that protects the statistical mode counters.
- UINT Nwrites; ///< Number of times a single write must be physically repeated. See \ref NPF for an
- ///< explanation
- UINT Multiple_Write_Counter; ///< Counts the number of times a single write has already physically repeated.
- NDIS_EVENT WriteEvent; ///< Event used to synchronize the multiple write process.
- NDIS_EVENT IOEvent; ///< Event used to synchronize I/O requests with the callback structure of NDIS.
- NDIS_STATUS IOStatus; ///< Maintains the status of and OID request call, that will be passed to the application.
- BOOLEAN Bound; ///< Specifies if NPF is still bound to the adapter used by this instance. Bound can be
- ///< FALSE if a Plug and Play adapter has been removed or disabled by the user.
- HANDLE DumpFileHandle; ///< Handle of the file used in dump mode.
- PFILE_OBJECT DumpFileObject; ///< Pointer to the object of the file used in dump mode.
-// PKTHREAD DumpThreadObject; ///< Pointer to the object of the thread used in dump mode.
- HANDLE DumpThreadHandle; ///< Handle of the thread created by dump mode to asynchronously move the buffer to disk.
- NDIS_EVENT DumpEvent; ///< Event used to synchronize the dump thread with the tap when the instance is in dump mode.
- LARGE_INTEGER DumpOffset; ///< Current offset in the dump file.
- UNICODE_STRING DumpFileName; ///< String containing the name of the dump file.
- UINT MaxDumpBytes; ///< Maximum dimension in bytes of the dump file. If the dump file reaches this size it
- ///< will be closed. A value of 0 means unlimited size.
- UINT MaxDumpPacks; ///< Maximum number of packets that will be saved in the dump file. If this number of
- ///< packets is reached the dump will be closed. A value of 0 means unlimited number of
- ///< packets.
- BOOLEAN DumpLimitReached; ///< TRUE if the maximum dimension of the dump file (MaxDumpBytes or MaxDumpPacks) is
- ///< reached.
- MEM_TYPE mem_ex; ///< Memory used by the TME virtual co-processor
- TME_CORE tme; ///< Data structure containing the virtualization of the TME co-processor
- NDIS_SPIN_LOCK machine_lock; ///< SpinLock that protects the mem_ex buffer
+ PMDL BufferMdl; ///< Pointer to a Memory descriptor list (MDL) that maps the circular buffer's memory.
+ PKEVENT ReadEvent; ///< Pointer to the event on which the read calls on this instance must wait.
+ HANDLE ReadEventHandle; ///< Handle of the event on which the read calls on this instance must wait.
+ UNICODE_STRING ReadEventName; ///< Name of the event on which the read calls on this instance must wait.
+ ///< The event is created with a name, so it can be used at user level to know when it
+ ///< is possible to access the driver without being blocked. This fiels stores the name
+ ///< that and is used by the BIOCGEVNAME IOCTL call.
+ INT Received; ///< Number of packets received by current instance from its opening, i.e. number of
+ ///< packet received by the network adapter since the beginning of the
+ ///< capture/monitoring/dump session.
+ INT Dropped; ///< Number of packet that current instance had to drop, from its opening. A packet
+ ///< is dropped if there is no more space to store it in the circular buffer that the
+ ///< driver associates to current instance.
+ INT Accepted; ///< Number of packet that current capture instance acepted, from its opening. A packet
+ ///< is accepted if it passes the filter and fits in the buffer. Accepted packets are the
+ ///< ones that reach the application.
+ PUCHAR bpfprogram; ///< Pointer to the filtering pseudo-code associated with current instance of the driver.
+ ///< This code is used only in particular situations (for example when the packet received
+ ///< from the NIC driver is stored in two non-consecutive buffers. In normal situations
+ ///< the filtering routine created by the JIT compiler and pointed by the next field
+ ///< is used. See \ref NPF for details on the filtering process.
+ JIT_BPF_Filter *Filter; ///< Pointer to the native filtering function created by the jitter.
+ ///< See BPF_jitter() for details.
+ PUCHAR Buffer; ///< Pointer to the circular buffer associated with every driver instance. It contains the
+ ///< data that will be passed to the application. See \ref NPF for details.
+ UINT Bhead; ///< Head of the circular buffer.
+ UINT Btail; ///< Tail of the circular buffer.
+ UINT BufSize; ///< Size of the circular buffer.
+ UINT BLastByte; ///< Position of the last valid byte in the circular buffer.
+ PMDL TransferMdl; ///< MDL used to map the portion of the buffer that will contain an incoming packet.
+ ///< Used by NdisTransferData().
+ NDIS_SPIN_LOCK BufLock; ///< SpinLock that protects the access tho the circular buffer variables.
+ UINT MinToCopy; ///< Minimum amount of data in the circular buffer that unlocks a read. Set with the
+ ///< BIOCSMINTOCOPY IOCTL.
+ LARGE_INTEGER TimeOut; ///< Timeout after which a read is released, also if the amount of data in the buffer is
+ ///< less than MinToCopy. Set with the BIOCSRTIMEOUT IOCTL.
+
+ int mode; ///< Working mode of the driver. See PacketSetMode() for details.
+ LARGE_INTEGER Nbytes; ///< Amount of bytes accepted by the filter when this instance is in statistical mode.
+ LARGE_INTEGER Npackets; ///< Number of packets accepted by the filter when this instance is in statistical mode.
+ NDIS_SPIN_LOCK CountersLock; ///< SpinLock that protects the statistical mode counters.
+ UINT Nwrites; ///< Number of times a single write must be physically repeated. See \ref NPF for an
+ ///< explanation
+ UINT Multiple_Write_Counter; ///< Counts the number of times a single write has already physically repeated.
+ NDIS_EVENT WriteEvent; ///< Event used to synchronize the multiple write process.
+ NDIS_EVENT IOEvent; ///< Event used to synchronize I/O requests with the callback structure of NDIS.
+ NDIS_STATUS IOStatus; ///< Maintains the status of and OID request call, that will be passed to the application.
+ BOOLEAN Bound; ///< Specifies if NPF is still bound to the adapter used by this instance. Bound can be
+ ///< FALSE if a Plug and Play adapter has been removed or disabled by the user.
+ HANDLE DumpFileHandle; ///< Handle of the file used in dump mode.
+ PFILE_OBJECT DumpFileObject; ///< Pointer to the object of the file used in dump mode.
+ PKTHREAD DumpThreadObject; ///< Pointer to the object of the thread used in dump mode.
+ HANDLE DumpThreadHandle; ///< Handle of the thread created by dump mode to asynchronously move the buffer to disk.
+ NDIS_EVENT DumpEvent; ///< Event used to synchronize the dump thread with the tap when the instance is in dump mode.
+ LARGE_INTEGER DumpOffset; ///< Current offset in the dump file.
+ UNICODE_STRING DumpFileName; ///< String containing the name of the dump file.
+ UINT MaxDumpBytes; ///< Maximum dimension in bytes of the dump file. If the dump file reaches this size it
+ ///< will be closed. A value of 0 means unlimited size.
+ UINT MaxDumpPacks; ///< Maximum number of packets that will be saved in the dump file. If this number of
+ ///< packets is reached the dump will be closed. A value of 0 means unlimited number of
+ ///< packets.
+ BOOLEAN DumpLimitReached; ///< TRUE if the maximum dimension of the dump file (MaxDumpBytes or MaxDumpPacks) is
+ ///< reached.
+ MEM_TYPE mem_ex; ///< Memory used by the TME virtual co-processor
+ TME_CORE tme; ///< Data structure containing the virtualization of the TME co-processor
+ NDIS_SPIN_LOCK machine_lock; ///< SpinLock that protects the mem_ex buffer
+ UINT MaxFrameSize; ///< Maximum frame size that the underlying MAC acceptes. Used to perform a check on the
+ ///< size of the frames sent with NPF_Write() or NPF_BufferedWrite().