RawPacket

Historical C++/CLI reference: The NdisApi.RawPacket class represents a single raw network packet intercepted by the filter driver. It belongs to the C++/CLI binding in wiresock/ndisapi.

Properties & Usage

• Data: Managed byte[] containing the Ethernet frame.
• DeviceFlags: Direction flags indicating whether the packet was captured on send or receive.
• NdisFlags: NDIS packet flags.
• Dot1q: 802.1Q VLAN information.
• FilterId: Identifier of the filter that redirected the packet for processing.
• Checksums: IPv4 checksum recalculation flags used when sending the packet.

The adapter handle is supplied separately to the historical binding’s ReadPacket, SendPacketToAdapter, and SendPacketToMstcp methods. It is not a RawPacket property. The class is defined in ndisapicl.h.

Current C# Binding

The current NdisApiDotNet C# project uses the unsafe NdisApiDotNet.Native.NdisApi.INTERMEDIATE_BUFFER interop structure for packet data. Its fields include m_IBuffer, m_Length, and m_dwDeviceFlags; its AdapterHandle property belongs to that structure. Packet requests use ETH_REQUEST or ETH_M_REQUEST, with reusable buffers allocated through the C# wrapper. See the .NET interface guide for source setup.