On Wednesday 23 March 2005 21:55, Loris Degioanni wrote: > Ethereal is based on winpcap, so the fact that it's able to keep up > means that either: > - there's something wrong in the way you interact with winpcap. For > example, your timeout is very short: this not only causes pcap_next_ex() > to timeout very often, but possibly increases CPU load. > - your application is too slow in processing the packets, the capture > buffers become full and your capture instance drops packets. > > Loris
Loris, Thanks for your feedback. It made me inspect my application a little closer. I think I found the source of my problem. I was checking caplen for a minimum value. If it was less than a certain value I would ignore the packet. When I logged the value of caplen I found it was either a very large value or a negative value. So I was missing packets everytime it showed up negative. So I changed the application to ignore caplen and it has been working as expected for about two hours. Do you know why caplen contains a bogus value? It looks like the entire pcap_pkthdr structure returned from pcap_next_ex() contains bogus information. Thanks, Tom ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/winpcap-users@winpcap.polito.it/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
