ndis

Provenance

Defined in ndis.sys, the binary that emits these events.

• Win11-26200.6584, schema recovered from debug symbols, binary version 10.0.26100.5074, PDB signature 077DB4377990F631D5F6475AE8925FE51, captured 2026-06-02 — ndis WPP/TMF statements (in the Win11-26200.6584 TMF pack) — TMF corpus provenance and drift model (Win11-26200.6584)

  ndis.sys was recovered from Microsoft's public symbol server. These are low-level developer trace messages whose internal identifiers Windows renumbers on every build, so a capture decodes correctly only against the exact binary it came from. Match the PDB signature above to the ndis.sys on your own host before decoding a captured trace.