Wireshark · Display Filter Reference: ETW Ndis

Field name	Description	Type	Versions
etw.ndis.classification_handle_net_buffer_list_info	ClassificationHandleNetBufferListInfo	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.context	Context	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.description	Description	Character string	2.6.0 to 4.4.2
etw.ndis.destination_count	Destination count	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.destination_nic_name	Destination NIC name	Character string	2.6.0 to 4.4.2
etw.ndis.destination_nic_type	Destination NIC type	Character string	2.6.0 to 4.4.2
etw.ndis.destination_port_id	Destination port ID	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.destination_port_name	Destination port name	Character string	2.6.0 to 4.4.2
etw.ndis.directive	Directive	Unsigned integer (8 bits)	2.6.0 to 4.4.2
etw.ndis.error_code	Error code	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.event_id	Event ID	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.fragment	Fragment	Byte sequence	2.6.0 to 4.4.2
etw.ndis.fragment_size	Fragment size	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.friendly_name	Friendly name	Character string	2.6.0 to 4.4.2
etw.ndis.ieee8021q_net_buffer_list_info	Ieee8021QNetBufferListInfo	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.if_index	IfIndex	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.ipsec_offload_v1_net_buffer_list_info	IPsecOffloadV1NetBufferListInfo	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.keyword	Keyword	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.keyword.address	KW_ADDRESS	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.authentication	KW_AUTHENTICATION	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.close_path	KW_CLOSE	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.configuration	KW_CONFIGURATION	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.connect_path	KW_L2_CONNECT	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.dropped	KW_DROPPED	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.ethernet8023	KW_MEDIA_802_3	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.global	KW_GLOBAL	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.l3_connect_path	KW_L3_CONNECT	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.native80211	KW_MEDIA_NATIVE_802_11	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.packet	KW_PACKET	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.packet_end	KW_PACKET_END	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.packet_start	KW_PACKET_START	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.pii_present	KW_PII_PRESENT	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.receive_path	KW_RECEIVE	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.reserved1	Reserved1	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.keyword.reserved2	Reserved2	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.keyword.reserved3	Reserved3	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.keyword.reserved4	Reserved4	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.keyword.reserved5	Reserved5	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.keyword.send_path	KW_SEND	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.state_transition	KW_STATE_TRANSITION	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.std_template_hint	KW_STD_TEMPLATE_HINT	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.tunnel	KW_MEDIA_TUNNEL	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.vmswitch	KW_VMSWITCH	Boolean	2.6.0 to 4.4.2
etw.ndis.keyword.wireless_wan	KW_MEDIA_WIRELESS_WAN	Boolean	2.6.0 to 4.4.2
etw.ndis.layer_count	Layer count	Unsigned integer (16 bits)	2.6.0 to 4.4.2
etw.ndis.layer_id	Layer ID	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.layer_name	Layer name	Character string	2.6.0 to 4.4.2
etw.ndis.location	Location	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.lower_if_index	LowerIfIndex	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.max_net_buffer_list_info	MaxNetBufferListInfo	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.media_specific_information	MediaSpecificInformation	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.media_type	Media types	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.metadata	Metadata	Byte sequence	2.6.0 to 4.4.2
etw.ndis.metadata_size	Metadata size	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.miniport_if_index	MiniportIfIndex	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.net_buffer_cancel_id	NetBufferListCancelId	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.net_buffer_list_frame_type	NetBufferListFrameTypeOrNetBufferListProtocolId	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.net_buffer_list_hash_info	NetBufferListHashInfo	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.net_buffer_list_hash_value	NetBufferListHashValue	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.next_state	Next state	Unsigned integer (8 bits)	2.6.0 to 4.4.2
etw.ndis.oob_data	OOB data	Byte sequence	2.6.0 to 4.4.2
etw.ndis.oob_data_size	OOB data size	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.data	MPDU padding	Byte sequence	2.6.0 to 4.4.2
etw.ndis.packet_metadata.revision	Revision	Unsigned integer (8 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.size	Size	Unsigned integer (16 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.type	Type	Unsigned integer (8 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.wifi_channel	Channel	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.wifi_datarate	Datarate	Unsigned integer (8 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.wifi_flags	Flags	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.wifi_mpdu_padding	MPDU padding	Byte sequence	2.6.0 to 4.4.2
etw.ndis.packet_metadata.wifi_mpdus_received	MPDUs received	Unsigned integer (16 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.wifi_phytype	PHY type	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.packet_metadata.wifi_rssi	RSSI	Signed integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.param1	Param1	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.param2	Param2	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.param_str	Param String	Character string	2.6.0 to 4.4.2
etw.ndis.previous_state	Previous state	Unsigned integer (8 bits)	2.6.0 to 4.4.2
etw.ndis.reference_context	Reference context	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.rule_id	Rule ID	Unsigned integer (8 bits)	2.6.0 to 4.4.2
etw.ndis.rules_count	Rules count	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.rundown_id	Rundown ID	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.service_name	Service name	Character string	2.6.0 to 4.4.2
etw.ndis.source_id	Source ID	Unsigned integer (8 bits)	2.6.0 to 4.4.2
etw.ndis.source_name	Source name	Character string	2.6.0 to 4.4.2
etw.ndis.source_nic_name	Source NIC name	Character string	2.6.0 to 4.4.2
etw.ndis.source_nic_type	Source NIC type	Character string	2.6.0 to 4.4.2
etw.ndis.source_port_id	Source port ID	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.source_port_name	Source port name	Character string	2.6.0 to 4.4.2
etw.ndis.tcp_ip_checksum_net_buffer_list	TcpIpChecksumNetBufferListInfoOrTcpOffloadBytesTransferred	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.tcp_large_send_net_buffer_list_info	TcpLargeSendNetBufferListInfoOrTcpReceiveNoPush	Unsigned integer (64 bits)	2.6.0 to 4.4.2
etw.ndis.unique_name	Unique name	Character string	2.6.0 to 4.4.2
etw.ndis.value	Value	Byte sequence	2.6.0 to 4.4.2
etw.ndis.value_length	Value length	Unsigned integer (32 bits)	2.6.0 to 4.4.2
etw.ndis.version	Version	Character string	2.6.0 to 4.4.2
etw.ndis.wpf_net_buffer_list_info	WfpNetBufferListInfo	Unsigned integer (64 bits)	2.6.0 to 4.4.2