ndis - Calls FilterAttach in filter driver -

i create ndis network filter driver when install see "filterattach" call 4 times.
why "filterattach" call 4 times in filter driver?

there 3 reasons you'll see many filterattach calls in driver:

• multiple nics,
• monitoring filters, and
• ndis binding recalculations

let's @ each in detail.

multiple nics

filter drivers bind filter module each nic compatible filter driver. if have 3 compatible nics, you'll @ least 3 calls filterattach.

 [tcpip]    [tcpip]    [tcpip]     |          |          | [filter1]  [filter2]  [filter3]     |          |          |  [nic1]     [nic2]     [nic3] 

you can tell you're in situation because ndis_filter_attach_parameters::baseminiportifindex value different across different filterattach instances. means filter getting bound on different nics.

monitoring filters

an ndis lwf either monitoring or modifying. in inf file see type of filter have:

; monitoring filter, use this: ;     hkr, ndi,filtertype,0x00010001, 1 ; monitoring filter ; modifying filter, use this: ;     hkr, ndi,filtertype,0x00010001, 2 ; modifying filter 

the difference between monitoring , modifying in how these filters bind network card. modifying filter simplest: bind once per network card. in contrast, monitoring filters bind once for each other modifying filter, , 1 more time nic itself. here's diagram of happens when have monitoring filter , 2 modifying filters:

  [tcpip]      | [monitoring1]   // 3      | [modifying2]      | [monitoring1]   // 2      | [modifying1]      | [monitoring1]   // 1      |    [nic] 

the key thing notice in diagram same monitoring filter attached 3 times stack: once on nic, , once on each of 2 modifying filters (modifying1 , modifying2).

if don't want monitoring filter bind @ each altitude that, can return ndis_status_not_supported filterattach handler time ndis_filter_attach_parameters::lowerifindex different ndis_filter_attach_parameters::baseminiportifindex. if have mandatory filter, should set ndis_filter_attach_flags_ignore_mandatory flag in ndis_filter_attach_parameters::flags, note not recommend marking monitoring filter mandatory.

you can tell you're in situation if ndis_filter_attach_parameters::baseminiportifindex same in both calls filterattach, ndis_filter_attach_parameters::filtermoduleguidnameis different. thebaseminiportifindextells miniport filter over, , thefiltermoduleguidname` tells filter instance attaching.

ndis binding recalculations

the final reason filter may see multiple calls filterattach routine because ndis recalculates bindings. maybe new filter getting installed below filter — ndis unbind filter (filterdetach) bind new filter, bind filter again (filterattach).

you can tell ndis re-trying filter due binding recalculation because ndis_filter_attach_parameters::filtermoduleguidname same previous call filterattach. means ndis attaching filter in same spot before.

debugging tips

if have kernel debugger attached, can use !ndiskd.filterdriver see filter attached. can use !ndiskd.netreport see graphical visualization of network stack.