This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(48, 95%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EUD%3C/text%3E%3C/svg%3E)
There is network interface index which can be obtained by IP Helper API. Also there is such thing as network sub-interface index which I am struggling to find a way to access.
I am using a third party library which comes with a driver that eventually calls FwpsInjectNetworkReceiveAsync0 function of the Windows Filtering Platform. My user mode code is supposed to deliver this sub-interface index for that function to use, but I do not know where to get it from.
I have looked through the IP Helper API, but all I could find were the functions that return the interface index, not the sub-interface one. Not much information in documentation either it would seem: some enumerations, a few kernel mode functions that require it as argument, but none that would actually deliver it.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(179.20000000000002, 34%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EXY%3C/text%3E%3C/svg%3E)
The FwpsInjectNetworkReceiveAsync0 cooperate with FwpsCalloutRegister0. The classifyFn0 callout function of FWPS_CALLOUT0 structure will receive the information. There is a GitHub sample.
Edit: I also find the PPP_PROJECTION_INFO structure has the SubInterfaceIndex information.
This classifyFn0 function is a kernel mode function as far as I understand, and in the sample you linked to it is said that this is for driver. I need to do this from the user mode.
As for the PPP_PROJECTION_INFO structure, I am not sure about this either. Seems like it is used for some specific case involving some specific protocols. I followed the documentation and this is where it got me:
1) PPP_PROJECTION_INFO is part of PROJECTION_INFO
2) PROJECTION_INFO is part of RAS_CONNECTION_EX
3) RAS_CONNECTION_EX is used in MPRAPI_ADMIN_DLL_CALLBACKS as argument for some callback functions which seem to just listen to certain specific events. I do not need to listen to any events, I just need to get all available sub-interface indexes immediately. Something like what is done by IP Helper API where knowing the local IP address I can easily get the “regular” interface index
I know the command netsh interface ipv4/ipv6 show subinterfaces can display information about all subinterfaces, or about all subinterfaces on a given interface if one is specified.
It seems Netsh does not really give any sub-interface index number in its output. Or at least its idea of what sub-interface actually is is vastly different from what Windows Filtering Platform expects.
The information that it provides is exactly identical to what IP Helper API gives me when I query for “regular” interface indexes. For instance netsh interface ipv4 show subinterface shows “Loopback Pseudo-Interface 1”, “Ethernet” on my machine along with a few others. So does the IP Helper API, telling me that “Loopback Pseudo-Interface 1” has an interface index of 1, “Ethernet” is 8 and so on. These numbers are interface indexes, I am certain about that.
Unless the order in which items are displayed is somehow important and could count as this sub-interface index, but I doubt it.
At this point I am really confused about what this “sub-interface index” actually represents.
I suppose sub-interface index only make sense in the scope of Fwps* functions.
