How to get raw data from NET_BUFFER_LIST

NTDEV
1

How to get raw data from _NET_BUFFER_LIST structure ?
Let’s say i am writing NDIS filter driver. There is _NET_BUFFER_LIST structure.
How do i get the traffic raw data and print it to my debugger screen.

2

NET_BUFFER_LIST is list of NET_BUFFER_LIST

NET_BUFFER_LIST is list of NET_BUFFER

NET_BUFFER is list of MDL

So your reading will be recursive.

ReadNetbufferList ----- Read all single NET_BUFFER_LIST and then concatenate

ReadNetBufferListSingle — Read all single NET_BUFFER and then concatenate

ReadNetBuffer – Read all MDLs and then concatenate

ReadMDL – Code to read data in MDL

You can use NdisGetDataBuffer to get all data from NET_BUFFER as optimization