FwpsAllocateCloneNetBufferList0 function

The FwpsAllocateCloneNetBufferList0 function allocates a NET_BUFFER_LIST structure that is a clone of an existing NET_BUFFER_LIST structure.

Note  FwpsAllocateCloneNetBufferList0 is a specific version of FwpsAllocateCloneNetBufferList. See WFP Version-Independent Names and Targeting Specific Versions of Windows for more information.


NTSTATUS NTAPI FwpsAllocateCloneNetBufferList0(
  _Inout_  NET_BUFFER_LIST *originalNetBufferList,
  _In_opt_ NDIS_HANDLE     netBufferListPoolHandle,
  _In_opt_ NDIS_HANDLE     netBufferPoolHandle,
  _In_     ULONG           allocateCloneFlags,
  _Out_    NET_BUFFER_LIST **netBufferList


originalNetBufferList [in, out]

A pointer to the original NET_BUFFER_LIST structure that is being cloned.

netBufferListPoolHandle [in, optional]

A NET_BUFFER_LIST pool handle that was obtained from a previous call to the NdisAllocateNetBufferListPool function. This parameter is optional and can be NULL.

netBufferPoolHandle [in, optional]

A NET_BUFFER pool handle that was obtained from a previous call to the NdisAllocateNetBufferPool function. This parameter is optional and can be NULL.

allocateCloneFlags [in]

There are currently no flags defined for this function. Callout drivers should set this parameter to zero.

netBufferList [out]

A pointer to a variable that receives a pointer to the clone NET_BUFFER_LIST structure.

Return value

The FwpsAllocateCloneNetBufferList0 function returns one of the following NTSTATUS codes.

Return codeDescription

The clone NET_BUFFER_LIST structure was successfully allocated.

Other status codes

An error occurred.



A callout driver calls the FwpsAllocateCloneNetBufferList0 function to allocate a clone NET_BUFFER_LIST structure of an existing NET_BUFFER_LIST structure.

This function is a wrapper around the NdisAllocateCloneNetBufferList function, but it is specialized for use by WFP packet injection functions.

If the clone NET_BUFFER_LIST structure should have attributes that are associated with a specific pool, the callout driver must specify the pool handle in the NetBufferListPoolHandle or NetBufferPoolHandle parameter. If these parameters are NULL, the default pool preallocated by NDIS is used.

The clone NET_BUFFER_LIST structure describes the same data that is described by the original NET_BUFFER_LIST structure. The FwpsAllocateCloneNetBufferList0 function does not copy the data that is described by the original MDLs to new data buffers. Instead, the clone NET_BUFFER_LIST structure references the original data buffers. The clone NET_BUFFER_LIST structure does not include an initial NET_BUFFER_LIST_CONTEXT structure.

This function sets the ParentNetBufferList member of the newly created clone NET_BUFFER_LIST structure to point to the parent NET_BUFFER_LIST structure. The parent structure's ChildRefCount member is incremented by 1.

A callout driver can modify the clone NET_BUFFER_LIST structure and inject it into the network stack in place of the original NET_BUFFER_LIST structure by calling the packet injection functions. After the data described by the clone NET_BUFFER_LIST structure has been successfully injected into the network stack, the callout driver frees the clone NET_BUFFER_LIST structure by calling the FwpsFreeCloneNetBufferList0 function.

A callout driver can insert or replace individual net buffers (NET_BUFFER) or MDLs inside the clone net buffer list. Such a driver must also undo the modifications before it calls the FwpsFreeCloneNetBufferList0 function.

Guidelines for Managing Cloned Packets

A callout driver must not hold cloned packets indefinitely. A cloned packet can interfere with power management operations on an idle computer.

The intended use for cloned packets in WFP is to get clarification from a user-mode application or other relatively fast operation. The callout driver must not hold cloned packets while, for example, waiting for user input, or waiting for web service clearance, or waiting for any other operation that might take an arbitrary amount of time.

If the callout driver needs to wait for a potentially lengthy operation, it makes a deep copy of the packet using FwpsAllocateNetBufferAndNetBufferList0, and it blocks and absorbs the original packet.

Another alternative is for the callout driver to listen to query power management, for example by using the I/O request packet (IRP) IRP_MN_QUERY_POWER. When the computer is entering sleep or hibernation, the callout must release any held packets.


Target platform



Available starting with Windows Vista.


Fwpsk.h (include Fwpsk.h)





See also

Packet Injection Functions



Send comments about this topic to Microsoft