I didn't say that I handle million packets per second. I said that I handle millions of packets with a mechanism similar to WinPcap (i.e. receiving one packet at a time with a call similar to pcap_next_ex). Consider that at those rates, sometimes the limitation is not just WinPcap, it's the NIC and NIC driver, that are sometimes not optimized to properly handle small packets. In general the idea of using multiple threads and capture instances, each of them capturing a subset of the traffic, is a winning one, as long as you are able to split the traffic evenly among threads.
Have a nice day GV From: [email protected] [mailto:[email protected]] On Behalf Of Neil Powell Sent: Thursday, March 24, 2011 4:33 PM To: [email protected] Subject: Re: [Winpcap-users] Followup question on Old Post Gianluca, You mention that you can get WinPCAP to handle millions of packets a second. I'd be very interested to understand the basic idea on how you got WinPCAP to do this. I have developed an application that currently handles 100,000 packets per second; now I need to scale it up to handle around a 1,000,000 packets per second or more. The packet size can range from 64bytes to 1514bytes; but typically around 100bytes. I too have been thinking about using multiple kernel buffers and multiple threads each with a specific filter set. Is this the ideal way to get the best performance from WinPCAP? If not what philosophy would you suggest? . Thanks in advance Neil Powell
_______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
