[prev in list] [next in list] [prev in thread] [next in thread]
List: winpcap-users
Subject: Re: [Winpcap-users] How can i get
From: "rst" <slash () realscene ! com ! tw>
Date: 2009-05-26 9:19:27
Message-ID: 005101c9dde3$15359e80$de00a8c0 () IBMNBWin2K
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
The machine always sending packets , never stop.
and my computer only connected with the machine (using a crossover network cable).
so every packets I get are what I wanted, but only the newest packet I need.
Machine ----(Sending packets)---> My Computer .........................every \
0.000005 second
My Application ----(Get the newest packet)---> Get information to do \
control...................every 0.0001 second
if the buffer can contrain 10000 packets,
0.000005 * 10000 = 0.05 second,
so I can only get the information before 0.05 second,
but in my realtime control, i must get the information less than 0.0001 second.
so have any ideas?
Really thank you!!
If the other machine is sending a constant 200,000 packets per second and won't \
slow down, you may be out of luck. However, if the other machine sends 200,000 \
packet per second for a short burst (say 10 seconds), then you should be able to \
store those 2M packets into your own memory space. After you store the packets, you \
can do your analysis.
For a quick test, just change your control loop to do...
static int counter;
pcap_next_ex(...);
counter++;
That is, don't do anything with the packet (other than advance the buffer and count \
how many you receive). This will tell you how fast your machine can move through the \
buffer.
If this works well, then you need to do a memcpy() of the packet into pre-allocated \
space (i.e. malloc your own circular queue). This will slow down the loop, but \
should be much faster than 0.1ms.
Last question: Most packet capturing applications need to decode EVERY packet, are \
you saying that you do NOT need to decode every packet? If not, how do you know \
which packets you need to decode and which ones you don't?
DC
[Attachment #5 (text/html)]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=big5">
<META content="MSHTML 6.00.2800.1625" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>The machine always sending packets , never stop.</FONT></DIV>
<DIV><FONT size=2>and my computer only connected with the machine (using a
crossover network cable).</FONT></DIV>
<DIV><FONT size=2>so every packets I get are what I wanted, but only the
newest packet I need.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Machine ----(Sending packets)---> My
Computer .........................every 0.000005
second</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>My Application ----(Get the newest packet)---> Get
information to do control...................every 0.0001 second</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>if the buffer can contrain 10000 packets,</FONT></DIV>
<DIV><FONT size=2>0.000005 * 10000 = 0.05 second,</FONT></DIV>
<DIV><FONT size=2>so I can only get the information before 0.05
second,</FONT></DIV>
<DIV><FONT size=2>but in my realtime control, i must get the information less
than 0.0001 second.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>so have any ideas?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Really thank you!!</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 \
2px solid; MARGIN-RIGHT: 0px"> <DIV><FONT face=Arial size=2>If the other machine is \
sending a constant 200,000 packets per second and won't slow down, you may be out \
of luck. However, if the other machine sends 200,000 packet per second for a \
short burst (say 10 seconds), then you should be able to store those 2M packets \
into your own memory space. After you store the packets, you can do your
analysis.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>For a quick test, just change your control loop
to do...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>static int counter;</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>pcap_next_ex(...);</FONT></DIV>
<DIV><FONT face=Arial size=2>counter++;</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>That is, don't do anything with the packet (other
than advance the buffer and count how many you receive). This will tell
you how fast your machine can move through the buffer.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>If this works well, then you need to do a
memcpy() of the packet into pre-allocated space (i.e. malloc your own circular
queue). This will slow down the loop, but should be much faster than
0.1ms.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Last question: Most packet capturing
applications need to decode EVERY packet, are you saying that you do NOT need
to decode every packet? If not, how do you know which packets you
need to decode and which ones you don't?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>DC</FONT></DIV></BLOCKQUOTE></BODY></HTML>
_______________________________________________
Winpcap-users mailing list
Winpcap-users@winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic