Edit

Filter Driver Characteristics

  • Article

Filter drivers have the following characteristics:

  • An instance of a filter driver is called a filter module. Filter modules are attached to an underlying miniport adapter. Multiple filter modules from the same filter driver or different filter drivers can be stacked over an adapter.

  • Overlying protocol drivers are not required to provide alternate functionality when filter modules are installed between such drivers and the underlying miniport drivers (otherwise stated, filter modules are transparent to overlying protocol drivers).

  • Because filter drivers do not implement virtual miniports like an intermediate driver, filter drivers are not associated with a device object. A miniport adapter with overlying filter modules functions as a modified version of the miniport adapter. For more information about the driver stack, see NDIS 6.0 Driver Stack.

  • NDIS uses configuration information to attach the filter modules to the adapter in the correct driver stack order. For more information about the driver stack order of filter modules, see INF File Settings for Filter Drivers.

  • NDIS can dynamically insert or delete filter modules in the driver stack, or reconfigure the filter modules, without tearing down the entire stack. For more information, see Modifying a Running Driver Stack.

  • Protocol drivers can obtain the list of filter modules in a driver stack when NDIS restarts the driver stack.

    For more information about the list of filter modules, see NDIS_PROTOCOL_RESTART_PARAMETERS.

  • Filter drivers can filter most communication to and from the underlying miniport adapter. Filter modules are not associated with any particular binding between overlying protocol drivers and the miniport adapter. For more information about the types of filtering services that a filter driver can provide, see Filter Driver Services.

  • Filter drivers can select the services that are filtered and can be bypassed for the services that are not filtered. The selection of the services that are bypassed and the services that are filtered can be reconfigured dynamically. For more information, see Data Bypass Mode.

  • NDIS guarantees the availability of context space (see NET_BUFFER_LIST_CONTEXT structure) for filter drivers. Therefore, filter drivers are not required to include the code to copy buffers to obtain context space. For more information about how to manage buffers, see Filter Driver Buffer Management.