The !ndiskd.nbl extension displays information about a NET_BUFFER_LIST (NBL) structure.
!ndiskd.nbl [-handle <x>] [-basic] [-chain] [-info] [-data] [-netmon] [-capfile <str>] [-launch] [-overwrite] [-log] [-stacks] [-NblCurrentOwner]
Required. Address of a NET_BUFFER_LIST structure.
Displays basic information about an NBL.
Displays all the NBLs and NET_BUFFERs in an NBL chain.
Displays all the out-of-band information that is associated with an NBL.
Displays the actual data payload of an NBL.
Views the NBL chain in Microsoft Network Monitor.
Specifies the path to which a netmon capture is saved.
Automatically launches netmon.exe after saving the capture file.
Allows overwriting the capture file if it already exists.
Shows NBL log if NBL history logging is enabled.
Includes callstacks with NBL log (use with -log).
Shows the current owner of the NBL.
In the following example, NBL tracking has been enabled to extract a handle for an NBL from the NBL log. For more information about NBL tracking and the NBL log, see !ndiskd.nbllog.
At the time of log collection, the NBL in this example was returned by the TCPIP6 protocol to the WFP Native Mac Layer LightWeight Filter.
2: kd> !ndiskd.nbl ffffdf80149524a0 NBL ffffdf80149524a0 Next NBL NULL First NB ffffdf8014952610 Source ffffdf80140c71a0 - Microsoft Kernel Debug Network Adapter Flags INDICATED, RETURNED, NBL_ALLOCATED, PROTOCOL_020_0, PROTOCOL_200_0 Walk the NBL chain Dump data payload Show out-of-band information Review NBL history
By clicking on the "Dump data payload" link from the previous example or by entering the !ndiskd.nbl -handle -data command, you can see the data payload of this NBL. In the following example, the NBL contains only one NET_BUFFER structure. To further explore the contents of that NET_BUFFER structure, run the !ndiskd.nb -handle command with its handle.
2: kd> !ndiskd.nbl ffffdf80149524a0 -data NET_BUFFER ffffdf8014952610