Understanding more about NDIS header split in send and receive path

DaveSC 20 Reputation points
2025-04-02T20:48:41.8733333+00:00

Good day all.

I just want more clarification on the NDIS Header split on send and receive.

The first thing I have noticed is that the header split rules apply to receive Path and that one NET_BUFFER_LIST pointing to one NET_BUFFER also pointing to one MDL.

Some of the header split rules on the Receive

  1. Do not split Non-IP frames(0x0800) and such protocols may include (ARP 0x0806, PPPOE 0x8863/64) etc.
  2. You can split in the middle of a header provided that the number of bytes in the first mdl is equal to the lookahead size.

upper layer protocols in this context are TCP, UDP and ICMP

  1. You can split IP Frames at the beginning of the tcp,udp,icmp header or at the tcp,udp payload (other rules for upper layer protocols).

As far as I understand it, this header split rules that are mentioned above (rule 1,2 and 3) are only applicable to the receive path. Now I would to verify If I

understood correctly, that on the sending side rules on header split

On the Send side

  1. You can have NET_BUFFER_LIST with a chain of NET_BUFFERS and each NET_BUFFER may have a chain of MDLs
  2. You should not split the packet in the middle of the header (eg ethernet, Ip and TCP), meaning you can only split at the end of the header.

Now I am writing a code that doesn't require copying buffers, I receive an IP (0x0800) packet from one adapter (let's call it adapter 1), but want to translate it to PPPOE, and then send

it to the other adapter (let's call it adapter 2).

The translation I will create a PPPOE packet (Ethernet Header (14 bytes) + PPPOE Header (6 bytes) and PPP header (2 bytes)) in the first MDL). The second MDL will point at the start of the IP header received from adapter 1. The first MDL points to the second MDL to make a chain.

Now I want to know the receive path header split rules will be enforced on the send path side (e.g. do not split non-IP frame meaning do not split PPPOE). I want to know if my algorithm and thinking is correct and that I am not violating any NDIS rules.Good day all.

I just want more clarification on the NDIS Header split on send and receive.

The first thing I have noticed is that the header split rules apply to receive Path and that one NET_BUFFER_LIST pointing to one NET_BUFFER also pointing to one MDL.

Some of the header split rules on the Receive

  1. Do not split Non-IP frames(0x0800) and such protocols may include (ARP 0x0806, PPPOE 0x8863/64) etc.
  2. You can split in the middle of a header provided that the number of bytes in the first mdl is equal to the lookahead size.

upper layer protocols in this context are TCP, UDP and ICMP

  1. You can split IP Frames at the beginning of the tcp,udp,icmp header or at the tcp,udp payload (other rules for upper layer protocols).

As far as I understand it, this header split rules that are mentioned above (rule 1,2 and 3) are only applicable to the receive path. Now I would to verify If I

understood correctly, that on the sending side rules on header split

On the Send side

  1. You can have NET_BUFFER_LIST with a chain of NET_BUFFERS and each NET_BUFFER may have a chain of MDLs
  2. You should not split the packet in the middle of the header (eg ethernet, Ip and TCP), meaning you can only split at the end of the header.

Now I am writing a code that doesn't require copying buffers, I receive an IP (0x0800) packet from one adapter (let's call it adapter 1), but want to translate it to PPPOE, and then send

it to the other adapter (let's call it adapter 2).

The translation I will create a PPPOE packet (Ethernet Header (14 bytes) + PPPOE Header (6 bytes) and PPP header (2 bytes)) in the first MDL). The second MDL will point at the start of the IP header received from adapter 1. The first MDL points to the second MDL to make a chain.

Now I want to know the receive path header split rules will be enforced on the send path side (e.g. do not split non-IP frame meaning do not split PPPOE). I want to know if my algorithm and thinking is correct and that I am not violating any NDIS rules.

Windows Hardware Performance
Windows Hardware Performance
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Hardware Performance: Delivering / providing hardware or hardware systems or adjusting / adapting hardware or hardware systems.
1,684 questions
0 comments No comments
{count} votes

Accepted answer
  1. Molly Lu-MSFT 2,586 Reputation points Microsoft External Staff
    2025-04-03T09:15:46.5066667+00:00

    Hello,

    Thank you for posting in Microsoft Q&A.

    Based on the description, I understand your question is related to NDIS header split in send and receive path.

    Non-IP Frames: Do not split non-IP frames such as ARP (0x0806) and PPPOE (0x8863/64) protocols.

    Splitting Headers: You can split in the middle of a header provided that the number of bytes in the first MDL is equal to the lookahead size.

    Upper Layer Protocols: For TCP, UDP, and ICMP, you can split IP frames at the beginning of the TCP, UDP, or ICMP header or at the TCP, UDP payload.

    You can have a NET_BUFFER_LIST with a chain of NET_BUFFERS, and each NET_BUFFER may have a chain of MDLs.

    Splitting Packets: You should not split the packet in the middle of the header (e.g., Ethernet, IP, and TCP). This means you can only split at the end of the header.

    Your approach to translating an IP packet to PPPOE and sending it to another adapter seems correct.

    Construct a PPPOE packet with the Ethernet Header (14 bytes), PPPOE Header (6 bytes), and PPP Header (2 bytes) in the first MDL.

    The second MDL will point to the start of the IP header received from adapter 1. The first MDL points to the second MDL to create a chain.

    To ensure that your algorithm and thinking are correct and that you are not violating any NDIS rules:

    Receive Path: The header split rules you mentioned are indeed applicable to the receive path. Ensure that non-IP frames are not split and that the headers are split correctly as per the rules.

    Send Path: On the send side, ensure that you do not split the packet in the middle of the header. Your approach of creating a PPPOE packet and chaining MDLs seems to comply with the rules.

    https://learn.microsoft.com/en-us/windows-hardware/drivers/network/header-data-split-architecture

    Have a nice day.

    Best Regards,

    Molly

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it

    0 comments No comments

0 additional answers

Sort by: Most helpful

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.