NDIS LWF driver causing issues for WFP drivers in the network stack?

Question

I have written a NDIS LWF driver, that gathers send/recv packets, and sends them to the user service, and the user service marks those that are OK, and then we indicate/send those packets that were marked as OK. Note that we first use NdisFSendNetBufferListComplete (in case of send) and NdisFIndicateREceiveNetBufferLists (in case of receive) in our LWF callbacks, and then we send the packets to the user afterwards, and we finally send/indicate those that are marked as OK.

But i have noticed that this is causing the windows 10's task manager to show 0% in every process for their network usage in the processes tab, even tho they are not 0%. And when i turn off the driver it get fixed.

But the weird thing is that his doesn't happen in the performance->ethernet tab and in the resource monitor program, and both of them show the actual network usage.

So what is causing this, and why can the resource monitor and the network tab still see the network usage? I think this has to do with the fact that probably resource monitor uses an NDIS filter and the network usage in the processes tab is using a WFP, but I'm not sure.

Answer 1

Does your driver call NdisCopySendNetBufferListInfo and NdisCopyRecieveNetBufferListInfo ?

The per-app accounting is indeed tracked using WFP callouts. There is a WFP callout at the top of the network stack that attaches app identity to each NET_BUFFER_LIST. There is another WFP callout at the bottom of the network stack (closest to the hardware) that does the actual byte-counting and bills each app for its network consumption.

If you simply clone the NET_BUFFER_LIST, that doesn't by default copy the app identity that is attached to the NET_BUFFER_LIST. You need to also call one of NdisCopySendNetBufferListInfo or NdisCopyRecieveNetBufferListInfo to copy that metadata.

Coincidentally there was another NDIS question yesterday for which I am writing the same answer ;) . So rather than write it all out again, you can refer to what I wrote here: Send doesn't work properly in my NDIS modifying filter driver