On Wednesday 23 March 2005 21:55, Loris Degioanni wrote:
> Ethereal is based on winpcap, so the fact that it's able to keep up
> means that either:
> - there's something wrong in the way you interact with winpcap. For
> example, your timeout is very short: this not only causes pcap_next_ex()
> to timeout very often, but possibly increases CPU load.
> - your application is too slow in processing the packets, the capture
> buffers become full and your capture instance drops packets.
>
> Loris

Loris,

Thanks for your feedback. It made me inspect my application a little closer. I 
think I found the source of my problem. I was checking caplen for a minimum 
value. If it was less than a certain value I would ignore the packet. When I 
logged the value of caplen I found it was either a very large value or a 
negative value. So I was missing packets everytime it showed up negative. So 
I changed the application to ignore caplen and it has been working as 
expected for about two hours. Do you know why caplen contains a bogus value? 
It looks like the entire pcap_pkthdr structure returned from pcap_next_ex() 
contains bogus information.

Thanks,
Tom


==================================================================
 This is the WinPcap users list. It is archived at
 http://www.mail-archive.com/winpcap-users@winpcap.polito.it/

 To unsubscribe use 
 mailto: [EMAIL PROTECTED]
==================================================================

Reply via email to