Windows network driver developers interested in network interface card (NIC) drivers, Ethernet/IP packet interception, filtering and modification must have a good understanding of the Network Driver Interface Specification (NDIS).
In this document, I mainly focus on NDIS 5.0 or higher and on the most common network drivers (old Windows versions prior to 2000 are no longer widely used).
Introduction
NDIS is originally developed to hide the underlying complexity of the NIC hardware and to allow for multiple network adapters and higher level protocol drivers (such as TCP/IP, NetBEUI …) to coexist in a single computer. Early versions of NDIS were jointly developed by Microsoft and the 3Com Corporation. Versions starting from 2.0 are Microsoft proprietary specifications. The open source ndiswrapper project also allows many NDIS-compliant NICs to be used with Linux.
NDIS is implemented as kernel mode driver called NDIS.sys sometimes referred to as the NDIS wrapper. The later is a small piece of code surrounding all types of the NDIS device drivers. It aims to hide platform dependencies and to maintain state information and parameters for network drivers.
Next sections will describe most common NDIS driver types as illustrated in the following simplified diagram:
NDIS Protocol Driver
The NDIS Protocol is the highest driver in the NDIS hierarchy of drivers. At it upper edge, it exports ProtocolXxx functions to the lower edge of the transport protocol stack (such as a TCP/IP stack). At its lower edge, it interfaces with NDIS Intermediate drivers and NDIS miniport drivers.
Protocol drivers always use NDIS-provided functions to communicate with underlying NDIS drivers to send and receive packets. The NDIS wrapper also calls the ProtocolXxx functions for its own purposes or on behalf of lower-level drivers to indicate up received packets, indicate the status of lower-level drivers …
NDIS protocols driver are often used to inject or capture packets on the network.
NDIS Miniport Driver
A miniport driver is a driver that connects hardware devices to higher-level drivers (protocol drivers, Intermediate drivers and filter drivers) and implements sending and receiving data on the network adapter. The most common miniport drivers are:
- Connectionless miniport drivers
- Connection-oriented miniport drivers
- NDISWAN miniport drivers
- Non-NDIS Lower Interface miniport drivers
Connectionless miniport drivers control NICs for connectionless network media, such as Ethernet, FDDI, and Token Ring. Connectionless miniport drivers can be serialized or deserialized. Serialized drivers rely on NDIS to sequence calls to miniport functions and to manage send queues. Deserialized miniport drivers internally queue all incoming send packets rather than using NDIS. This can result in a better full duplex performance.
Connection-oriented miniport drivers control NICs for connection-oriented network media, such as ISDN. Connection-oriented miniport drivers are always deserialized and a connection must be established between two points before data can be exchanged.
NDISWAN miniport contains the necessary code to operate the dial-up equipment. They are used with ISDN, Frame Relay and X.25.
A Non-NDIS lower interface driver is a connection-oriented miniport driver that exposes a standard NDIS miniport driver interface on the top, but on the bottom can interface to devices, such as USB, IEEE 1394, and serial devices by sending I/O request packets (IRPs).
NDIS Virtual Miniport Driver
A virtual miniport driver is a miniport driver that does not interact directly with any physical network adapter. A virtual miniport driver adds a virtual adapter that shows up in the network connections and ipconfig result.
NDIS virtual miniport drivers are used in several VPN clients and virtualization softwares.
NDIS Intermediate Driver
An NDIS intermediate driver, also called NDIS IM driver, looks like a protocol driver to an underlying miniport driver and looks like a miniport driver to an overlying protocol driver. An intermediate driver is inserted just above miniport drivers and just below transport protocols in the overall networking protocol stack allowing incoming and outgoing packets filtering, inspection or modification. There are two types of NDIS intermediate driver: the LAN emulation intermediate driver and the Filter driver.
The LAN emulation intermediate driver translates packets from the overlying connectionless transport’s LAN format to the connection-oriented format (such as ATM) allow them to be sent over a separate and a different medium.
Filter drivers perform special operations (such as compression, encryption and tracing) on packets being transported through them. Various services utilize this type driver, such as the packet scheduler in Quality of Service (QoS) and Network Load Balancing.
NDIS Lightweight Filter Driver
NDIS Lightweight Filter drivers (LWF drivers) are introduced in NDIS 6.0 to replace NDIS intermediate drivers. They are typically layered between miniport adapters and protocol bindings and offer the same packets filtering, inspection or modification capabilities. NDIS Lightweight Filter drivers always use NDIS-provided functions, are easier to implement and are designed to improve overall performances.
Kamel Messaoudi 