_INTERMEDIATE_BUFFER

struct _INTERMEDIATE_BUFFER
{
    union
    {
        HANDLE     m_hAdapter;
        LIST_ENTRY m_qLink;
    };
    ULONG          m_dwDeviceFlags;
    ULONG          m_Length;
    ULONG          m_Flags;    // NDIS_PACKET flags
    ULONG          m_8021q;    // 802.1q VLAN tag information
    ULONG          m_FilterID;
    ULONG          m_Reserved[4];
    UCHAR          m_IBuffer[MAX_ETHER_FRAME];
};

The _INTERMEDIATE_BUFFER structure represents an intercepted network packet transferred between kernel mode (ndisrd.sys) and user-mode applications.

m_hAdapter / m_qLink
A union field:

m_hAdapter: In user-mode batch unsorted operations (ReadPacketsUnsorted and SendPacketsToAdaptersUnsorted), m_hAdapter stores the adapter handle. When reading, it identifies which network adapter received the packet. When sending, it specifies which network adapter will transmit the packet.
m_qLink: Internal doubly-linked list entry used by the kernel driver for queue management.

m_dwDeviceFlags
Indicates packet direction: PACKET_FLAG_ON_SEND for outbound packets or PACKET_FLAG_ON_RECEIVE for inbound packets.

m_Length
Length of the packet data contained in m_IBuffer in bytes.

m_Flags
NDIS packet flags.

m_8021q
802.1Q VLAN priority and VLAN ID information if present.

m_FilterID
Identifier of the static filter rule that matched this packet (if redirected by a static filter).

m_IBuffer
Fixed-size buffer containing raw Ethernet frame data. In the supplied header, MAX_ETHER_FRAME is 1514 bytes by default, or 9014 bytes when JUMBO_FRAME_SUPPORTED is defined. This is a compile-time layout choice, not a per-packet capacity setting; the application and installed driver must use compatible buffer layouts. m_Length must fit within the configured capacity.

See Also