Hi.
The answer is not so simple.
Our latest tests show that:
- the biggest overhead is the NIC driver; so performance can vary quite a
lot by changing that piece of software
- there are some hidden problems (for example the timestamp management) in
Win32 that have a non negligible overhead (the next version of WinPcap will
solve that point)
- in any case, our tests show that WinPcap is more performing than libpcap,
on an identical machine with W2k and BSD with standard configuration. You
can see the results on the published paper.
Latest point: you cannot compare apple with pears. When you say "WinPcap has
more complexities" it makes no sense because:
- the NIC driver insert a non negligible overhead (and the NIC driver is not
WinPcap neither libpcap)
- when you save to disk, the disk management routines are part of the OS and
not part of WInPcap / libpcap
==> there are several components (NIC, kernel driver i.e. BPF/NPF, disk
management) that are external to WinPcap / libpcap.
In order to compare WinPcap and libpcap correctly, you have to isolate each
component and test them. A global test (packet captured / saved to disk)
gives just overall performance. However, other components could impact more
heavily than WinPcap/libpcap.
Cheers,
fulvio
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]On Behalf Of Mehdi
Kianpour
Sent: Sunday, September 23, 2001 13:30
To: tcpdump
Subject: [tcpdump-workers] packet loss in windump
About differences between winpcap and libpcap that I pointed out before; I
had run tcpdump on a 100 Mb/s network with about 6-8% utilization for 5
minutes. At last it was printed: 135906 packets received by filter, 0
packets dropped by Kernel.
I had run windump on the same network for 5 minutes again and I had:
80016 packets received by filter, 41728 packets dropped by kernel. I even
enlarge the Buffer size to 32M with -B 32000 tag and although it was really
better but it had packet loss yet.
what I have understood from this, is that winpcap has more complexities so
the packet loss is more than libpcap.
please comment about it.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
