However, my application is multi-threaded with the thread that is reading
the packets at highest priority and it does not do a great deal of processing
before it stores the data in memory for lower priority threads to process and
write it to disk.
Robert Thornthwaite
Input/Output, Inc.
phone: 281 879 2112
email: [EMAIL PROTECTED]
web: http://www.i-o.com/
-----Original Message-----
From: Robert Thornthwaite
Sent: Thursday, May 13, 2004 9:41 AM
To: [EMAIL PROTECTED]
Subject: RE: [WinPcap-users] Capture packets, Process, & Continue...I have not used that adapter. I have had very good results with the Intel PRO/1000 MT desktop adapter when using it at 100Mbits. Note: that since this adapter is designed for 1000Mbit operation it may be even more able to work at 100Mbit speed. When I try my test with the 3COM 3C996B-T, I never get all the packets.I use pcap_setbuff(mDeviceHandle, KERNEL_BUFFERSIZE) with KERNEL_BUFFERSIZE == 15000000 and pcap_setmintocopy(mDeviceHandle, MIN_READ_COPY) with MIN_READ_COPY == 500000. You also have to look at how you set any parameters to your adapter. In my case 10ms or even 100ms is not a problem.Robert ThornthwaiteInput/Output, Inc.-----Original Message-----
From: Bala, Srinath [mailto:[EMAIL PROTECTED]
Sent: Thursday, May 13, 2004 9:11 AM
To: '[EMAIL PROTECTED]'
Subject: RE: [WinPcap-users] Capture packets, Process, & Continue...I am using a 3COM 3C905C-TX adapter.I guess my real question is:if I am using pcap_next_ex() in a loop, and doing other operations in the loop after receiving the pkt, for say 10ms, do I loose packets being received during those 10ms ???Or does winpcap keep the pkts, do they can be processed the next time I call pcap_next_ex() ???pseudo code:while (1){if (pcap_next_ex() == 1){do something with pkt....(10ms loop)}}Thanks, Srinath____________________________________________________________________________
-----Original Message-----
From: Robert Thornthwaite [mailto:[EMAIL PROTECTED]
Sent: Thursday, May 06, 2004 8:42 PM
To: [EMAIL PROTECTED]
Subject: RE: [WinPcap-users] Capture packets, Process, & Continue...Srinath,You do not say what kind of adapters you are using.I have been using gigabit adapters and trying to transmit and receive packets at gigabit speeds using WinPcap on Windows XP. My experience is that if you are trying to sustain a data transfer for much longer than 5000 packets you will begin to lose packets. The Intel 1000/PRO adapters are a little better than the 3com adapters. I have found that I can get more reliable transmission if I run the gigbit adapters at 100mb speeds. My experience is that fewer packets are lost when doing a sustained transfer at 90% of the 100Mbit link than when transferring data at the same rate over a gigabit link. The problem seems to be that OS and drives cannot cope with transmissions that happen in bursts unless the bursts are quite small say 1000 packets with an interval of dead time between the bursts. I am only trying to use one adapter in each PC.With the current driver design I do not believe it is possible to get more than 20% of the bandwidth of Gigabit Ethernet even if one avoids large bursts of packets. As you approach 20% many packets will be lost.In summary I would say that if you need capture packets with gigabit adapters you are going to be disappointed. There is a company called Endace that sells a hardware/software solution for Linux. I have not been able to find out exactly what Endace will offer for Windows. There may be other Linux solutions. I think the WinPcap developers may be working on something.Regards,Robert-----Original Message-----
From: Bala, Srinath [mailto:[EMAIL PROTECTED]
Sent: Wednesday, May 05, 2004 4:18 PM
To: '[EMAIL PROTECTED]'
Subject: [WinPcap-users] Capture packets, Process, & Continue...Hello,
I have used winpcap so far to be able to capture packets, and process them, from more than 1 adapter.
While doing so, some packets from an adapter do NOT get captured, as the pcap_next_ex() for that adapter is not being called at this very moment.
I believe this means using threads is a must, right ?
Can winpcap allow packets to be captured in a BIG buffer for future processing? and still allow ALL packets to be captured ?
Could packet.dll help in this regard, as it is more low level than winpcap ?
Thanks, Srinath
