About NdisQueryPacket!!

device driver

    Sponsored Links


  • 1. Image processing
    I'm doing a monitoring software, and I want to know if exist any function in kernel mode driver ".sys" file to capture desktop screenshot or active windows, and save it to a bmp file. There is any way to do this without directx Thanks
  • 2. XP vs Vista Signed Driver
    Hi All - I am currently working with developers to produce a network device driver for some proprietary hardware. We have successfully completed WHQL testing and submission and we recieved the signed CAB file from Microsoft. Our developers created an install package with this and everything looks great on XP, however when it is installed on a Vista machine the OS complains that the driver is not signed. If anyone has any ideas as to why this would be happening I would greatly appreciate the input. Thanks! Jamie
  • 3. WDF - User Mode Driver Framework - COM port driver
    Hello I hit the group again with similiar question but I still want to clarify some open points. Is it possible to use WDF UMDF (User Mode Driver Framework) and write a user mode driver for COM port. I need a driver that exists as a COM driver (so OpenComPort/WriteFile/ReadFile) for COM device are handled by it and transferred over TCP/IP. I started development with DDK and kernel mode driver that uses TDI, but I wonder whether is it possible to use something simpler like WDF and UMDF? There I have access to sockets and C++ - development is easier. In my driver I do not have to really hit any devices - my driver must simply transferr all data that is sent to COM port from application to appropiate IP address and backward. Can anyone recommend me a best approach? Thanks
  • 4. Winusb vendor supplied control command transfer to the device
    Hi all I wanna use control pipe of usb to send the vendor supplied commands to the device (i.e usb printer) I am using winusb to do so, but I am not getting the way through which I could send custom commands to the device. Could any one pls provide me with the details needed to do so. thanxs

About NdisQueryPacket!!

Postby QWJvdXQgTmRpc1F1ZXJ5UGFja2V0 » Tue, 22 Feb 2005 19:53:03 GMT

     I am writint an IMD driver using 2003 DDK. But now , I find there's 
something wrong with NdisQueryPacket:
    In function MPSendPackets( or MPSend), I access the Packet through the 
following code:
VOID PrintPacket(IN PNDIS_PACKET Packet)
UINT PhyBufCount = 0;
UINT BufCount = 0;
UINT TotalPacketSize;
DbgPrint("PhyBufCount = %d BufCount =%d TotalPacketSize 

Unfortunately, sometimes(when accessed through the network neighbor), the 
value of TotalPacketSize is bigger than 1514 which is the max size of 
Ethernet frame.

why ? any idea? thanks you very much.

Re: About NdisQueryPacket!!

Postby Stephan Wolf [MVP] » Wed, 23 Feb 2005 02:34:01 GMT

Check the value that your IM returns for OID_GEN_MAXIMUM_FRAME_SIZE

I suggest you run the NDISTest tool against your IM to reveal problems
like this, see e.g.


On Mon, 21 Feb 2005 02:53:03 -0800, About NdisQueryPacket <About

Re: About NdisQueryPacket!!

Postby Pavel A. » Wed, 23 Feb 2005 09:27:11 GMT

Can you tell what exactly is the TotalPacketSize?

Re: About NdisQueryPacket!!

Postby RnJvZw » Wed, 23 Feb 2005 10:33:02 GMT

If error happens , in most case ,the wrong packet size is 16114, and 
sometimes 17574. why?  Is there something wrong with NdisQueryPacket itself? 
Thank you.  

Re: About NdisQueryPacket!!

Postby Pavel A. » Wed, 23 Feb 2005 11:21:43 GMT

Maybe yes. These numbers are too big - can't be explained by VLAN tags or anything like.

RE: About NdisQueryPacket!!

Postby RnJvZw » Wed, 23 Feb 2005 12:29:01 GMT

Is there something wrong with NdisQueryPacket in 2003 DDK? or else?

Re: About NdisQueryPacket!!

Postby Thomas F. Divine [DDK MVP] » Wed, 23 Feb 2005 13:12:16 GMT


Could this be an adapter that supports Large Send function of NDIS Task 

If the number was a little smaller I might think it was a Gigabit NIC 
sending Jumbo frames, but I don't think that Jumbo frames are that large...

Thomas F. Divine, Windows DDK MVP

Re: About NdisQueryPacket!!

Postby RnJvZw » Wed, 23 Feb 2005 14:49:06 GMT

yes, it is a Gigabit NIC. Does Passthru not support Gigabit NIC? thank you. 

Re: About NdisQueryPacket!!

Postby RnJvZw » Wed, 23 Feb 2005 14:59:02 GMT

yes, it is a Gigabit NIC . Does passthru not support Gigabit NIC ? how to do 
it? thank you.

Re: About NdisQueryPacket!!

Postby Thomas F. Divine [DDK MVP] » Wed, 23 Feb 2005 15:23:52 GMT

PassThru supports Gigabit Jumbo frames fairly nicely AFAIK. You will simply 
see packet total sizes that are larger than 1514 bytes. The maximum Jumbo 
packet size is set on the Advanced tab of the adapter's Properties dailog in 
the Network Control Pannel.

You can query for the maximum total size using OID_GEN_MAXIMUM_TOTAL_SIZE. 
Tools like OIDScope can let you make the query fairly simply. See:


If the value that you are seeing from NdisQueryPacket is bigger that the 
value returned by the OID_GEN_MAXIMUM_TOTAL_SIZE query or is larger than the 
Jumbo frame size specified for the adapter, then there is some other 

Good luck,

Thomas F. Divine, Windows DDK MVP

Re: About NdisQueryPacket!!

Postby Stephan Wolf [MVP] » Wed, 23 Feb 2005 19:20:55 GMT

On Mon, 21 Feb 2005 23:12:16 -0500, "Thomas F. Divine [DDK MVP]"

IIRC, maximum Jumbo frame size is 14+9000=9014 bytes (standard frame
size is 14+1500=1514).

OP: Have you..

1. ..verified what you return for OID_GEN_MAXIMUM_FRAME_SIZE
and OID_GEN_MAXIMUM_TOTAL_SIZE as I requested earlier? Try Thomas'
OIDScope tool, see

  http://www.**--****.com/ #OIDScope

2. ..run the NDISTest tool against your IM?

Please don't come back here before you checked all that.


Re: About NdisQueryPacket!!

Postby Stephan Wolf [MVP] » Wed, 23 Feb 2005 19:33:53 GMT

On Mon, 21 Feb 2005 19:29:01 -0800, "Frog"

No. Also try NdisRecalculatePacketCounts() before calling
NdisQueryPacket() and see if that helps.


Re: About NdisQueryPacket!!

Postby Jeff Henkels » Wed, 23 Feb 2005 21:30:16 GMT

Going slightly offtopic, how can I make large send happen?  I've written a 
NDIS IM driver that I want to test with large send, running on XP SP2 with a 
Netgear GA311.  I've turned on large send and checksum offloading in the NIC 
properties and I see & properly handle the OID_TCP_TASK_OFFLOAD request 
(i.e. I don't modify what the NIC returns).  Jumbo frames are also enabled, 

Having switched on large send support, I see only standard 1514-byte 
packets, no matter what tools I use to send data -- ssh, ftp, and even your 
own ttcp.  I do see the NDIS_PACKET_EXTENSION for checksum offloading and 
properly handle those packets, but I never see anything related to large 
send.  I've done an extensive web search for info, with no results -- does 
XP even support large send, or will I have to switch to Server 2003 for 

Re: About NdisQueryPacket!!

Postby Stephan Wolf [MVP] » Thu, 24 Feb 2005 01:02:10 GMT

Please note all of the following:

From  http://www.**--****.com/ 

"NOTE: TCP Segmentation Offload is in Windows 2000, but it is disabled
by default in the registry. Microsoft recommends that hardware vendors
use Windows 2000 as a development platform for TCP Segmentation
Offload adapters, enabling it in registry. At this time, Microsoft
does not recommend using TCP Segmentation Offload in end-user
environments except for Beta testing of hardware and drivers."


"Notes on TCP/IP Offload Tasks
Although the same network adapter can offload several of these tasks,
when an IPSec policy is assigned, the checksum and TCP large send
offloads are disabled."

Not sure if NDISTest also tests large send offload, see e.g.


On Tue, 22 Feb 2005 07:30:16 -0500, "Jeff Henkels"

Re: About NdisQueryPacket!!

Postby RnJvZw » Thu, 24 Feb 2005 09:55:06 GMT

Thank you very much. 
I have used Oidscope.exe to get some values. The result is :

And you are right, At last, I find if I disable the "Large Send Offload"  
then my IM will work well. on the other hand, ifI enable the "Large Send 
Offload", then my IM will not work well. So  NdisQueryPacket will return a 
big value when Large Send Offload is enabled.However, when I try to query 
OID_TCP_TASK_OFFLOAD using Oidscope, it  always doesn't respond.

Similar Threads:

1.NdisQueryBufferSafe returns zero buffer length when NdisQueryPacket says there is more data


NdisQueryPacket says the total length is 142 say and the packet has 3

Buffer 1 is 14  length

Buffer 2 is 20  length

Buffer 3 is 0  length

So the Ethernet and IP header are there, the payload is missing.

The Packet type is ESP.  A Nortel VPN client on the PC.

If DNE is run on the PC, the third buffer has the correct length of

Any ideas on this?

2.NDIS Miniport Driver for winCE (**error while using NdisQueryPacket function)


 I am facing some issue while compiling my Ndis Miniport driver source
The issue is while using the ndis function "NdisQueryPacket"(its
actualy a macro). I am using eVC++ 4.0 for compiling. I have platform
builder 4.2 istalled in my sysytem. While compiling driver source code
in eVC++ am getting the following error

'UserKInfo' : undeclared identifier
'KINX_PAGESIZE' : undeclared identifier

I have noticed that this error is coming due to the expansion of macro
"NdisQueryPacket" which it is defined in Ndis.h.

**Do you have any idea whats wrong, pls help.

Also while including the header file ndis.h am getting the following
info in my bild window

WINCE420\PUBLIC\COMMON\DDK\INC\ceddk.h(45): Could not find the file

But the "macwin32.h" file is absent in my system.Its no were there in
ddk or sdk directories.

Pls share your thoughts

Thanks in advance

Bijesh V.M.

Return to device driver


Who is online

Users browsing this forum: No registered users and 59 guest