How to monitor the event indication between NDIS and 802.11 NIC from user mode

Posted on 2005-04-28
Last Modified: 2013-12-09
Dear experts,

I wanna to enable my application the cabability to record and monitor the status of 802.11 NIC real-time.  The DDK document of NdisMIndicateStatus() showes that 802.11 NIC probably indicates the link status, such as NDIS_STATUS_MEDIA_DISCONNECT and NDIS_STATUS_MEDIA_CONNECT, to ndis by NdisMIndicateStatus().

Could you please tell me if there is any possible idea and example to get these indications form IO manager, the ISR of ndis, or some kinds of virtual NIC?

Thank you very much!

Question by:overlook
    LVL 4

    Expert Comment

    Hi Liang,

    The OID you can use for monitoring NIC status is OID_GEN_MEDIA_CONNECT_STATUS. It works like the 802.11 Wireless LAN OIDs. The values you can get from the NIC are these:

    - NdisMediaStateConnected
    - NdisMediaStateDisconnected

    For more information about OID_GEN_MEDIA_CONNECT_STATUS:

    If you want to know what OIDs your device supports, please have a look to OID_GEN_SUPPORTED_LIST (

    Author Comment

    Thanks for the rapid expertise feedback.

    Do you mean I can query the OID_GEN_MEDIA_CONNECT_STATUS periodicly in my application to get the current status of 802.11 NIC?

    However, the polling mechanism can not get all the events generated by 802.11 NIC.  According to Microsoft's document "IEEE 802.11 Network Adapter Design Guidelines for Windows XP", Native WiFi driver not only generates meida connect event when the association status changes, but also trigger a notification to the upper layer when the RSSI is below or above the threshold.  

    Anyway, it's desireable if there is a facility to capture the registered NDIS events in user mode.

    LVL 4

    Expert Comment

    Then set an RSSI trigger value. This value not only determines whether the signal strength (RSSI) changes, but also when a media-specific status indication happened.

    These media-specific status indications are:

    - Received signal strength indication.
    - Authentication indication.
    - Pairwise master key ID candidate indication.
    - Media streaming indication.
    - Radio state indication.

    For RSSI indications, the buffer referenced by StatusBuffer must contain an NDIS_802_11_RSSI value.

    For the other indications, the buffer referenced by StatusBuffer must contain the following structure:

    typedef struct _NDIS_802_11_STATUS_INDICATION
      NDIS_802_11_STATUS_TYPE  StatusType;

    The NDIS_802_11_STATUS_TYPE enumeration has the following values:

    - Ndis802_11StatusType_Authentication
    - Ndis802_11StatusType_PMKID_CandidateList
    - Ndis802_11StatusType_MediaStreamMode
    - Ndis802_11StatusType_RadioState
    LVL 4

    Expert Comment

    A correction to the above. Setting an RSSI trigger value only will retrieve media-specific RSSI indications (signal strength).

    To retrive Authentication, Pairwise master key ID candidate, Media streaming and Radio state indications you have to use NdisMIndicateStatus function with the GeneralStatus parameter set to NDIS_STATUS_MEDIA_SPECIFIC_INDICATION.

    Sorry about that.
    LVL 4

    Expert Comment

    Maybe you can try IOCTL_NDISUIO_REQUEST_NOTIFICATION. This IOCTL allows the application to get adapter-related notifications. It fills in a NDISUIO_DEVICE_NOTIFICATION structure. This strcture is for device notification of Media State, bind/unbind, power up/down, adapter arrival/removal, etc.

    Author Comment

    I tried to get the connection status information via the DeviceIoControl interface.  However, the return value fails to be matched with the expected value:  NDIS_STATUS_MEDIA_CONNECT and NDIS_STATUS_MEDIA_DISCONNECT.


    NDIS_STATUS                  Dot11_GetMediaConnectStatus(
          HANDLE      handle )
          UCHAR                               buf[1024];
          NDIS_STATUS                        status = S_OK;
          PNDISUIO_QUERY_OID            pQueryOid;
          DWORD                              dwBytesReturned;
          DWORD                              dwError;

          pQueryOid = (PNDISUIO_QUERY_OID)&buf[0];
          pQueryOid->Oid = OID_GEN_MEDIA_CONNECT_STATUS;

          if (!DeviceIoControl(
                            (LPVOID) &buf[0],
                            (LPVOID) &buf[0],
                dwError = GetLastError();
                DEBUGP(("IOCTL GET_MEDIA_CONNECT_STATUS  failed: %d\n", dwError));
                status = E_FAIL;

          memcpy( &status, buf, sizeof(NDIS_STATUS));

          if( status == NDIS_STATUS_MEDIA_CONNECT )
                PRINTF(("media connected.\n"));
          else if( status == NDIS_STATUS_MEDIA_DISCONNECT )
                PRINTF(("media disconnected.\n"));
                PRINTF(("undefined return value.\n"));

          return status;
    LVL 4

    Accepted Solution

    Try this:

    - Initialize buf: UCHAR buf[ 1024 ] = { 0 };


    - Copy pQueryOid->Data instead of buf (it doesn't really matter) and change sizeof( NDIS_STATUS ) for sizeof( NDIS_MEDIA_STATE ).
    memcpy( &status, pQueryOid->Data, sizeof( NDIS_MEDIA_STATE ) );

    - Then, if connected, you will have NdisMediaStateConnected. If disconnected, then you will get NdisMediaStateDisconnected.

    I'm getting correctly the connection status via this OID (OID_GEN_MEDIA_CONNECT_STATUS).

    Expert Comment


    i'm also trying to develop a deamon to monitor whether the Wi-Fi NIC is connected or not with Wi-Fi n/w. i want to catch the connected status and then load another C# application, and when the connection goes bad i want to pass a message to the loaded C# app. i cant go to 'rawether' library because it is commerial.

    but i'm unable to understant how to start with Win  DDK's NDIS. i'm not much familer with DDK. so can u explain how to monitor the Wi-Fi NIC connection status ' NDIS_STATUS_MEDIA_CONNECT' and 'NDIS_STATUS_MEDIA_DISCONNECT' with simple example.

    it is better if u can provide me a full solution of sample application as help.

    thanks in advance,

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    Suggested Solutions

    Progress means simplifying, not complicating. Bruno Munari Preface How to detect the name of the internal storage or an SD-card on Windows Mobile device from the desktop application? I got this question, when I was working on a PC applicati…
    As the title indicates, I have done this before. It chills me everytime I update the OS on my phone, ( because one time I did this and I essentially had a bricked …
    In this sixth video of the Xpdf series, we discuss and demonstrate the PDFtoPNG utility, which converts a multi-page PDF file to separate color, grayscale, or monochrome PNG files, creating one PNG file for each page in the PDF. It does this via a c…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now