Will multiple NBL be sent to classifyFn?

WFP only indicates a single net buffer list to callouts (that is, netBufferList->Next == NULL), except for the following cases:

• WFP can indicate net buffer list chains to callouts from the Stream layer.
• WFP indicates net buffer list chains to callouts when it classifies IP packet fragment groups in the forward path to callouts. Each net buffer list inside the chain describes a single fragment.

Fragment grouping at FORWARD layer is currently disabled by default and can only be enabled via netsh command.

For completeness, for inbound packets you can safely assume there is only one (1) NET_BUFFER for each NET_BUFFER_LIST; however an NET_BUFFER_LIST can contain multiple NET_BUFFER structures for outbound packets (e.g. TCP segmentation will result in multiple NET_BUFFERs per send)

Hope this helps,

Biao.W.

BiaoWang[MSFT] at 2007-10-3 >