I wanted to find out the differences between ReturnNetBufferListsHandler and ReceiveNetBufferListsHandler, When does NDIS call these call backs. I have light weight filter which will modify the receiving and send packets on the NIC.
A LWF sits between a NIC driver and a protocol driver (like TCPIP). The LWF has a chance to intercept both the transmit (Tx) & the receive (Rx) path.
For Tx Whenever the protocol sends a packet, your filter's FilterSendNetBufferLists handler gets the packet. When you're done with the protocol's packet, call NdisFSendNetBufferListsComplete to return it back to the protocol.
If you'd like to transmit a packet to the NIC driver, call NdisFSendNetBufferLists. When the NIC driver is done with the Tx packet, your filter's FilterSendNetBufferListsComplete handler is called.
For a typical passthrough filter, then, the sequence of events looks like this:
1. FilterSendNetBufferLists 2. NdisFSendNetBufferLists 3. FilterSendNetBufferListsComplete 4. NdisFSendNetBufferListsComplete
For RX Whenever the NIC indicates a receive, your filter's FilterReceiveNetBufferLists handler gets the packet. When you're done with the NIC's packet, call NdisFReturnNetBufferLists. Except! if the special NDIS_RECIEVE_FLAG_RESOURCES flag is set.
If you'd like to indicate a receive to the protocol, call NdisFIndicateReceiveNetBufferLists. When the protocol is done with your packet, your FilterReturnNetBufferLists handler is called.
For a typical passthrough filter, then, the sequence of events looks like this:
1. FilterReceiveNetBufferLists 2. NdisFIndicateReceiveNetBufferLists 3. FilterReturnNetBufferLists 4. NdisFReturnNetBufferLists