_INTERMEDIATE_BUFFER

struct _INTERMEDIATE_BUFFER
{
    union
    {
        HANDLE     m_hAdapter;
        LIST_ENTRY m_qLink;
    };
    ULONG          m_dwDeviceFlags;
    ULONG          m_Length;
    ULONG          m_Flags;    // NDIS_PACKET flags
    ULONG          m_8021q;    // 802.1q VLAN tag information
    ULONG          m_FilterID;
    ULONG          m_Reserved[4];
    UCHAR          m_IBuffer[MAX_ETHER_FRAME];
};

The _INTERMEDIATE_BUFFER structure represents an intercepted network packet transferred between kernel mode (ndisrd.sys) and user-mode applications.

m_hAdapter / m_qLink
A union field:

m_hAdapter: In user-mode batch unsorted operations (ReadPacketsUnsorted and SendPacketsToAdaptersUnsorted), m_hAdapter stores the adapter handle. When reading, it identifies which network adapter received the packet. When sending, it specifies which network adapter will transmit the packet.
m_qLink: Internal doubly-linked list entry used by the kernel driver for queue management.

m_dwDeviceFlags
Indicates packet direction: PACKET_FLAG_ON_SEND for outbound packets or PACKET_FLAG_ON_RECEIVE for inbound packets.

m_Length
Length of the packet data contained in m_IBuffer in bytes.

m_Flags
NDIS packet flags.

m_8021q
802.1Q VLAN priority and VLAN ID information if present.

m_FilterID
Identifier of the static filter rule that matched this packet (if redirected by a static filter).

m_IBuffer
Buffer containing raw Ethernet frame data, up to MAX_ETHER_FRAME (typically 1514 bytes for standard Ethernet frames or up to jumbo frame limits).

See Also