How to retrieve the mac address from received NDIS datagram(NDIS 4) RRS feed

  • Question

  • I have a driver which is build using NDIS 4. The driver has a function implemented for the protocolReceive, and as per the prototype of this function

    NDIS_STATUS ProtocolReceive(
      _In_ NDIS_HANDLE ProtocolBindingContext,
      _In_ NDIS_HANDLE MacReceiveContext,
      _In_ PVOID       HeaderBuffer,
      _In_ UINT        HeaderBufferSize,
      _In_ PVOID       LookAheadBuffer,
      _In_ UINT        LookaheadBufferSize,
      _In_ UINT        PacketSize
    { ... }

    the second parameter i.e. MacReciveContext seems relevant but I find no information to retrieve the mac address.   

    Friday, January 22, 2016 10:17 AM


  • Wow, you're still maintaining an NDIS 4 driver? Do you really have NICs that are so brain-dead that they cannot indicate a complete packet? If not, then don't worry about ProtocolReceive, because ProtocolReceivePacket will be called instead.

    As written in the documentation, MacReceiveContext has nothing to do with fetching the MAC address, but is used with NdisTransferData. You'll find the MAC address in the packet header.


    Azius Developer Training Windows device driver, internals, security, & forensics training and consulting. Blog at

    Friday, January 22, 2016 7:10 PM