The segment-based interface supports capture to disk. The API used is exactly the same as for the packet-based interface except that when opening the network stream you specify segments instead of packets and every call to the NT_NetRxGet function returns a segment instead of a packet. Similarly, every call to the NT_NetRxRelease function releases a segment instead of a packet (see NTAPI).
The contents of the segments must always be accessed using the HAL (hardware abstraction layer) macros provided by the driver software, (see DN-0449) since this prepares the applications for possible future changes in segment content and layout. There are also HAL macros for helping traverse the packets in a segment.