This documentation is archived and is not being maintained.

IPAllocBuff function

Do not write a firewall-hook driver to process incoming and outgoing packets. For more information, see Firewall-Hook Drivers.

The IPAllocBuff function allocates memory for a packet buffer.


int IPAllocBuff(
  _Inout_ IPRcvBuf *pRcvBuf,
  _In_    UINT     Size


pRcvBuf [in, out]

Pointer to an IPRcvBuf structure that contains a pointer to a buffer that is to receive the allocated memory.

Size [in]

Size, in bytes, of the memory to be allocated for the buffer in pRcvBuf.

Return value

Returns 1 for success; otherwise any other integer for failure.


If a firewall hook creates a buffer for a new packet, the firewall hook should first allocate pool memory for a buffer descriptor (an IPRcvBuf structure) to contain that buffer before calling IPAllocBuff. To allocate memory for an IPRcvBuf structure, the firewall hook can call the ExAllocatePoolWithTag function. In this call, the firewall hook should specify to allocate nonpaged system memory and mark that memory as belonging to TCP. To mark the memory as belonging to TCP, the firewall hook passes the 'fPCT' string, which is just "TCP" spelled in reversed order. In this ExAllocatePoolWithTag call, the firewall hook should also specify the size of the memory as the size of an IPRcvBuf structure. If IPAllocBuff fails with a return value other than 1, the firewall hook should call the ExFreePool function to release the memory for the IPRcvBuf structure.

If the firewall hook must create more buffers and link those buffers in a chain, the firewall hook should repeat the process that was described in the previous paragraph and set the ipr_next member of each preceding IPRcvBuf structure to point to the following IPRcvBuf structure in the chain. To release memory for the chain of buffers including their buffer descriptors, the firewall hook should call the IPFreeBuff function and pass a pointer to the IPRcvBuf structure for the buffer descriptor at the head of the chain.

If the firewall hook just releases the memory for the buffer to which the ipr_buffer member of a IPRcvBuf structure points, the firewall hook calls the FreeIprBuff function and passes a pointer to that IPRcvBuf structure.


Target platform



Ipfirewall.h (include Ipfirewall.h)



See also




Send comments about this topic to Microsoft