ReadPacketsUnsorted

Available since: Windows Packet Filter 3.4.0

The ReadPacketsUnsorted function reads a batch of intercepted network packets from multiple network interfaces in a single system call. The receiving adapter for each packet is identified by the m_hAdapter field of the returned INTERMEDIATE_BUFFER.

Syntax

BOOL WINAPI ReadPacketsUnsorted(
    _In_    HANDLE                hOpen,
    _Inout_ PINTERMEDIATE_BUFFER* Packets,
    _In_    DWORD                 dwPacketsNum,
    _Out_   PDWORD                pdwPacketsSuccess
);

Parameters

hOpen
[in] Opaque library-object handle returned by OpenFilterDriver.

Packets
[in, out] An array of pointers to pre-allocated INTERMEDIATE_BUFFER structures that receive packet data.

dwPacketsNum
[in] The number of buffer pointers in the Packets array.

pdwPacketsSuccess
[out] Pointer to a DWORD that receives the number of packets read when the function returns TRUE. Ignore this count on FALSE.

Return Value

Returns TRUE if the operation succeeded; otherwise returns FALSE.

Remarks

ReadPacketsUnsorted operates via standard Windows buffered I/O (IOCTL_NDISRD_READ_PACKETS_UNSORTED). This function is not supported under WOW64 (a 32-bit process running on 64-bit Windows); the native SDK returns FALSE in that case. Use the ordinary per-adapter ReadPacket or ReadPackets APIs under WOW64.

See Also

SendPacketsToAdaptersUnsorted, SendPacketsToMstcpUnsorted, _INTERMEDIATE_BUFFER

Native SDK 3.6.2 output count

Use the output count only when the function returns TRUE. On the IOCTL path, the SDK copies request.packets_num into the output variable before returning, including on FALSE. If the driver has not changed that field, it still contains the requested packet count and is not evidence of successful processing.

The WOW64 precheck returns FALSE before writing the output count and does not set a new last-error value. Initialize your count if needed and check the Boolean before using it. See the pinned read/send implementations.