Kernel mode socket api on NDIS layer RRS feed

  • Question

  • Hi All,

    I want to achieve most of the socket api in kernel mode.
    There are so many stable code of kernel socket base on TDI layer.
    But I want to achieve this function on NDIS layer. 
    Could you please tell me, how can I do that, or give me some links about it.

    Best regards.

    Sunday, August 12, 2018 5:34 PM


  • It isn't clear what you're asking. NDIS is primarily concerned with miniport drivers at the Datalink layer, which is packets (which may or may not be delivered in order, and may also be further fragmented by routers) not streams of data. Your best bet is to use WSK (WinSock Kernel) for sending and receiving datagrams or streams. There are plenty of examples of how to use WSK in the WDK.

    FYI: You don't want to use TDI because the instant you have a TDI driver or client on the system all network traffic has to go through TDX (TDI translation layer), which will reduce performance.


    Azius Developer Training Windows device driver, internals, security, & forensics training and consulting. Blog at

    Monday, August 13, 2018 7:26 PM