Guided path: Networking stack tour
Step 7 of 7
NDIS and network adapters
The driver model that bridges protocol stacks and NIC hardware.
Related labs
Hands-on exercises for this area — in the browser or on a Windows machine.
View all labsOfficial Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
If you want to understand packet capture, offloads, VPNs, filters, or why a driver update changes performance, you eventually need the NDIS layer.
Mental model
NDIS is the contract between upper networking layers and the drivers that control physical or virtual adapters (miniports) plus filters that sit in between.
How it works
- 1Miniport drivers manage physical or virtual adapters and expose send/receive paths.
- 2Protocol drivers and filter drivers bind above miniports to implement features and policies.
- 3NDIS coordinates bindings, state, and standardized entry points across the stack.
Key terms
- Miniport
- NDIS driver that controls a network adapter and provides send/receive primitives.
- Filter driver
- An NDIS component that can observe/modify traffic between protocols and miniports.
Why 'offload' settings matter
Many performance features live in the adapter/miniport layer, so toggling offloads can change CPU usage and throughput drastically.
Common misconception
People look for 'the NIC driver' only. Real stacks include miniports plus filters and protocol bindings, and each can affect behavior.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
intermediate
TCP/IP stack
The core protocol machinery behind Windows network communication.
Related topic
intermediate
Filtering & firewalling
Where Windows observes and controls traffic with filtering layers.
Related topic
expert
WFP & BFE (deep dive)
How filters are stored, enforced, and hooked into the packet path.
Natural next depth in this branch