Display Filter Reference: ETW Ndis

Protocol field name: etw.ndis

Versions: 2.6.0 to 2.6.5

Back to Display Filter Reference

Field name Description Type Versions
etw.ndis.classification_handle_net_buffer_list_info ClassificationHandleNetBufferListInfo Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.context Context Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.description Description Character string 2.6.0 to 2.6.5
etw.ndis.destination_count Destination count Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.destination_nic_name Destination NIC name Character string 2.6.0 to 2.6.5
etw.ndis.destination_nic_type Destination NIC type Character string 2.6.0 to 2.6.5
etw.ndis.destination_port_id Destination port ID Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.destination_port_name Destination port name Character string 2.6.0 to 2.6.5
etw.ndis.directive Directive Unsigned integer, 1 byte 2.6.0 to 2.6.5
etw.ndis.error_code Error code Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.event_id Event ID Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.fragment Fragment Sequence of bytes 2.6.0 to 2.6.5
etw.ndis.fragment_size Fragment size Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.friendly_name Friendly name Character string 2.6.0 to 2.6.5
etw.ndis.ieee8021q_net_buffer_list_info Ieee8021QNetBufferListInfo Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.if_index IfIndex Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.ipsec_offload_v1_net_buffer_list_info IPsecOffloadV2NetBufferListInfo Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.keyword Keyword Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.keyword.address KW_ADDRESS Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.authentication KW_AUTHENTICATION Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.close_path KW_CLOSE Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.configuration KW_CONFIGURATION Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.connect_path KW_L2_CONNECT Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.dropped KW_DROPPED Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.ethernet8023 KW_MEDIA_802_3 Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.global KW_GLOBAL Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.l3_connect_path KW_L3_CONNECT Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.native80211 KW_MEDIA_NATIVE_802_11 Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.packet KW_PACKET Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.packet_end KW_PACKET_END Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.packet_start KW_PACKET_START Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.pii_present KW_PII_PRESENT Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.receive_path KW_RECEIVE Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.reserved1 Reserved1 Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.keyword.reserved2 Reserved2 Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.keyword.reserved3 Reserved3 Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.keyword.reserved4 Reserved4 Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.keyword.reserved5 Reserved5 Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.keyword.send_path KW_SEND Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.state_transition KW_STATE_TRANSITION Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.std_template_hint KW_STD_TEMPLATE_HINT Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.tunnel KW_MEDIA_TUNNEL Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.vmswitch KW_VMSWITCH Boolean 2.6.0 to 2.6.5
etw.ndis.keyword.wireless_wan KW_MEDIA_WIRELESS_WAN Boolean 2.6.0 to 2.6.5
etw.ndis.layer_count Layer count Unsigned integer, 2 bytes 2.6.0 to 2.6.5
etw.ndis.layer_id Layer ID Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.layer_name Layer name Character string 2.6.0 to 2.6.5
etw.ndis.location Location Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.lower_if_index LowerIfIndex Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.max_net_buffer_list_info MaxNetBufferListInfo Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.media_specific_information MediaSpecificInformation Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.media_type Media types Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.metadata Metadata Sequence of bytes 2.6.0 to 2.6.5
etw.ndis.metadata_size Metadata size Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.miniport_if_index MiniportIfIndex Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.net_buffer_cancel_id NetBufferListCancelId Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.net_buffer_list_frame_type NetBufferListFrameTypeOrNetBufferListProtocolId Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.net_buffer_list_hash_info NetBufferListHashInfo Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.net_buffer_list_hash_value NetBufferListHashValue Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.next_state Next state Unsigned integer, 1 byte 2.6.0 to 2.6.5
etw.ndis.oob_data OOB data Sequence of bytes 2.6.0 to 2.6.5
etw.ndis.oob_data_size OOB data size Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.packet_metadata.data MPDU padding Sequence of bytes 2.6.0 to 2.6.5
etw.ndis.packet_metadata.revision Revision Unsigned integer, 1 byte 2.6.0 to 2.6.5
etw.ndis.packet_metadata.size Size Unsigned integer, 2 bytes 2.6.0 to 2.6.5
etw.ndis.packet_metadata.type Type Unsigned integer, 1 byte 2.6.0 to 2.6.5
etw.ndis.packet_metadata.wifi_channel Channel Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.packet_metadata.wifi_datarate Datarate Unsigned integer, 1 byte 2.6.0 to 2.6.5
etw.ndis.packet_metadata.wifi_flags Flags Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.packet_metadata.wifi_mpdu_padding MPDU padding Sequence of bytes 2.6.0 to 2.6.5
etw.ndis.packet_metadata.wifi_mpdus_received MPDUs received Unsigned integer, 2 bytes 2.6.0 to 2.6.5
etw.ndis.packet_metadata.wifi_phytype PHY type Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.packet_metadata.wifi_rssi RSSI Signed integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.param1 Param1 Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.param2 Param2 Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.param_str Param String Character string 2.6.0 to 2.6.5
etw.ndis.previous_state Previous state Unsigned integer, 1 byte 2.6.0 to 2.6.5
etw.ndis.reference_context Reference context Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.rule_id Rule ID Unsigned integer, 1 byte 2.6.0 to 2.6.5
etw.ndis.rules_count Rules count Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.rundown_id Rundown ID Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.service_name Service name Character string 2.6.0 to 2.6.5
etw.ndis.source_id Source ID Unsigned integer, 1 byte 2.6.0 to 2.6.5
etw.ndis.source_name Source name Character string 2.6.0 to 2.6.5
etw.ndis.source_nic_name Source NIC name Character string 2.6.0 to 2.6.5
etw.ndis.source_nic_type Source NIC type Character string 2.6.0 to 2.6.5
etw.ndis.source_port_id Source port ID Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.source_port_name Source port name Character string 2.6.0 to 2.6.5
etw.ndis.tcp_ip_checksum_net_buffer_list TcpIpChecksumNetBufferListInfoOrTcpOffloadBytesTransferred Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.tcp_large_send_net_buffer_list_info TcpLargeSendNetBufferListInfoOrTcpReceiveNoPush Unsigned integer, 8 bytes 2.6.0 to 2.6.5
etw.ndis.unique_name Unique name Character string 2.6.0 to 2.6.5
etw.ndis.value Value Sequence of bytes 2.6.0 to 2.6.5
etw.ndis.value_length Value length Unsigned integer, 4 bytes 2.6.0 to 2.6.5
etw.ndis.version Version Character string 2.6.0 to 2.6.5
etw.ndis.wpf_net_buffer_list_info WfpNetBufferListInfo Unsigned integer, 8 bytes 2.6.0 to 2.6.5
Go Beyond with Riverbed Technology

Riverbed is Wireshark's primary sponsor and provides our funding. They also make great products that fully integrate with Wireshark.

I have a lot of traffic...

ANSWER: SteelCentral™ Packet Analyzer PE
  • • Visually rich, powerful LAN analyzer
  • • Quickly access very large pcap files
  • • Professional, customizable reports
  • • Advanced triggers and alerts
Learn More

Buy Now

No, really, I have a LOT of traffic…

ANSWER: SteelCentral™ AppResponse 11
  • • Full stack analysis – from packets to pages
  • • Rich performance metrics & pre-defined insights for fast problem identification/resolution
  • • Modular, flexible solution for deeply-analyzing network & application performance
Learn More