Filter Module States and Operations

A filter driver must support the following operational states for each filter module (instance of a filter driver) that the driver manages:

Detached
The Detached state is the initial state of a filter module. When a filter module is in this state, NDIS can call the filter driver's FilterAttach function to attach the filter module to the driver stack.

Attaching
In the Attaching state, a filter driver prepares to attach the filter module to the driver stack.

Paused
In the Paused state, the filter driver does not perform send or receive operations.

Restarting
In the Restarting state, a filter driver completes any operations that are required to restart send and receive operations for a filter module.

Running
In the Running state, a filter driver performs normal send and receive processing for a filter module.

Pausing
In the Pausing state, a filter driver completes any operations that are required to stop send and receive operations for a filter module.

In the following table, the headings are the filter module states. Major events are listed in the first column. The rest of the entries in the table specify the next state that the filter module enters after an event occurs within a state. The blank entries represent invalid event/state combinations.

The primary filter driver events are defined as follows:

Filter attach
NDIS called the driver's FilterAttach function to attach a filter module to a driver stack. For more information about attaching a filter module, see Attaching a Filter Module.

Attach is complete
When a filter module is in the Attaching state and the filter driver completes initialization of all the resources that the filter module requires, the filter module enters the Paused state.

Filter detach
NDIS called the driver's FilterDetach function to detach a filter module from a driver stack. For more information, see Detaching a Filter Module.

Filter restart
NDIS called the driver's FilterRestart function to restart a paused filter module. For more information, see Starting a Filter Module.

Restart is complete
When the filter module is in the Restarting state and the driver is ready to perform send and receive operations, the filter module enters the Running state.

Filter pause
NDIS called the driver's FilterPause function to pause a filter module. For more information, see Pausing a Filter Module.

Pause is complete
After the driver has completed all operations that are required to stop send and receive operations, the pause operation is complete and the filter module is in the Paused state.

Attach failed
If NDIS calls a driver's FilterAttach function and the attach operation fails (for example, because the required resources are not available), the filter module returns to the Detached state.

Restart failed
If NDIS calls a driver's FilterRestart function and the restart attempt fails, the filter module returns to the Paused state.

Send and Receive Operations
A driver can handle send and receive operations in the Running and Pausing states. For more information about send and receive operations, see Filter Module Send and Receive Operations.

OID Requests
A driver can handle OID requests in the Running, Restarting, Paused, and Pausing states. For more information about OID requests, see Filter Module OID Requests.