François,
HAMON François wrote:
Hi,
I want to design a program, which can send packets from a libpcap format file to an Ethernet network. As the example in the WinPcap manual "sendcap.c", I use the following function of WinPcap(3.0) with Windows Net4.0 : "pcap_open_offline" to open the capture,
"pcap_open_live" to open the output adaptater,
"pcap_sendqueue_queue" to fill the queue,
"pcap_sendqueue_transmit" to transmit the queue.
This example work correctly. However I want to change the timestamp in order to send the packets faster or slower to test the performance of a receiver. After the program has extracted the packet with the command "res = pcap_next_ex( indesc, &pktheader, &pktdata))", I have add 2 lines in order to modify the timeval in the packet header before the packet are sent in the queue : " (*pktheader).ts.tv_usec = timeusec[j];
(*pktheader).ts.tv_sec = timesec[j++];
"
timeusec and timesec are tables which contain the new timestamp values. I use Ethereal (Version 0.10.9) to sniff the network. And here comes the problems. The "sync" value is TRUE. And the timestamps I measure are different to the value that I have entered in the tables (for example: long timeusec[10] = {258155, 258185, 258215, 258315, 258415, 258515, 259015, 259515, 260015, 260035};. long timesec[10] = {1108287570, 1108287570, 1108287570, 1108287570, 1108287570, 1108287570, 1108287570, 1108287570, 1108287570, 1108287570};). I obtain the same timestamp than if the sync = FALSE.
But when I enter in the table the origin timestamps of the file, that work correctly with a good precision. Whereas when I entered timestamps above 100000usec (long timeusec[10] = {0,100000,200000,300000,400000,500000,600000,700000,800000,900000};) that also work correctly. Nevertheless the timestamp monitored are not as accurate than with the origin timestamps.
I noticed that when I send 10 packets with timestamp below to 100000usec, the program call the function DeviceIoControl (in the function PacketSendPackets [packet.dll]) only one time. If I put timestamp equal 1 sec, he call 10 times this functions.
How can I do to change the timestamp with a quite good accuracy (about 100usec) of a libpcap file that I send? What is the issue with my program (I give you a copy)?
Yes, the fact is that, in order to avoid to spend too much time in the kernel polling on KeQueryPerformanceCounter(), if the difference between two timestamps is too high the driver returns to the user for a certain time to wait on a regular OS sleep.
I have a new implementation based on a kernel thread, which should behave better in this regard, but I'll not integrate it in the main source before the release of winpcap 3.1.
Loris
================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/
To unsubscribe use mailto: [EMAIL PROTECTED]
==================================================================
