[prev in list] [next in list] [prev in thread] [next in thread]
List: winpcap-users
Subject: Re: [Winpcap-users] How
From: "Alan Jay Weiner" <a.weiner () valid8 ! com>
Date: 2009-05-27 17:24:30
Message-ID: 028e01c9deef$fef6d8b0$7157410a () valid8 ! local
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
Thanks for jumping in and correcting my misconception! I was following an
earlier comment about that; I should have checked that the information was
correct.
- Al -
----------------------------------------------------------------------------
Alan Jay Weiner / Valid8.com, Inc. - Conform, Perform & Excel(tm)
500 W Cummings Park, Suite #2700, Woburn, MA 01801, USA
a.weiner@valid8.com / Tel:+1-781-938-1221 x112, Fax +1-781-207-0550
http://www.VALID8.com
_____
From: winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] On Behalf Of Gianluca Varenni
Sent: Tuesday, May 26, 2009 1:22 PM
To: winpcap-users@winpcap.org
Subject: Re: [Winpcap-users] How
canigetthenew-estpacketfrombuffer?HELPPLEASE~!
Sorry for jumping in this conversation late.
Please be aware that WinPcap does *not* overwrite older packets with new
ones. If the kernel buffer (or the user buffer) is full, newer packets are
simply dropped.
Have a nice day
GV
----- Original Message -----
From: Alan Jay Weiner <mailto:a.weiner@valid8.com>
To: winpcap-users@winpcap.org
Sent: Tuesday, May 26, 2009 9:27 AM
Subject: Re: [Winpcap-users] How can
igetthenew-estpacketfrombuffer?HELPPLEASE~!
I presume the packets contain some kind of status conditions and you're
doing something based on the latest status.
What about using small buffers? The older data is overwritten by newer data
- if the buffer is only large enough for 1 or 2 packets, you'll get the 1 or
2 most-recent packets. All the other packets will be lost, but that seems
ok in your situation.
How many of the most-recent packets do you need? Is it sufficient to have
only the most-recent packet?
- Al Weiner -
----------------------------------------------------------------------------
Alan Jay Weiner / Valid8.com, Inc. - Conform, Perform & Excel(tm)
500 W Cummings Park, Suite #2700, Woburn, MA 01801, USA
a.weiner@valid8.com / Tel:+1-781-938-1221 x112, Fax +1-781-207-0550
http://www.VALID8.com
_____
From: winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] On Behalf Of rst
Sent: Tuesday, May 26, 2009 5:19 AM
To: winpcap-users@winpcap.org
Subject: Re: [Winpcap-users] How can i
getthenew-estpacketfrombuffer?HELPPLEASE~!
The machine always sending packets , never stop.
and my computer only connected with the machine (using a crossover network
cable).
so every packets I get are what I wanted, but only the newest packet I need.
Machine ----(Sending packets)---> My Computer
.........................every 0.000005 second
My Application ----(Get the newest packet)---> Get information to do
control...................every 0.0001 second
if the buffer can contrain 10000 packets,
0.000005 * 10000 = 0.05 second,
so I can only get the information before 0.05 second,
but in my realtime control, i must get the information less than 0.0001
second.
so have any ideas?
Really thank you!!
If the other machine is sending a constant 200,000 packets per second and
won't slow down, you may be out of luck. However, if the other machine
sends 200,000 packet per second for a short burst (say 10 seconds), then you
should be able to store those 2M packets into your own memory space. After
you store the packets, you can do your analysis.
For a quick test, just change your control loop to do...
static int counter;
pcap_next_ex(...);
counter++;
That is, don't do anything with the packet (other than advance the buffer
and count how many you receive). This will tell you how fast your machine
can move through the buffer.
If this works well, then you need to do a memcpy() of the packet into
pre-allocated space (i.e. malloc your own circular queue). This will slow
down the loop, but should be much faster than 0.1ms.
Last question: Most packet capturing applications need to decode EVERY
packet, are you saying that you do NOT need to decode every packet? If not,
how do you know which packets you need to decode and which ones you don't?
DC
_____
_______________________________________________
Winpcap-users mailing list
Winpcap-users@winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
[Attachment #5 (text/html)]
<html xmlns:v="urn:schemas-microsoft-com:vml" \
xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns:st1="urn:schemas-microsoft-com:office:smarttags" \
xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="country-region"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PostalCode"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="State"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="address"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="Street"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:PMingLiU;
panose-1:2 1 6 1 0 1 1 1 1 1;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@PMingLiU";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:PMingLiU;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle17
{mso-style-type:personal;
font-family:Arial;
color:navy;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Thanks for jumping in and correcting my
misconception! I was following an earlier comment about that; I should have
checked that the information was correct.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>- Al -<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New \
Roman";color:navy'> </span></font><font color=navy><span \
style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>----------------------------------------------------------------------------<br>
Alan Jay Weiner / Valid8.com, Inc. - Conform, Perform & Excel(tm)<br>
500 W Cummings Park, <st1:address w:st="on"><st1:Street w:st="on">Suite \
#</st1:Street>2700</st1:address>, <st1:place w:st="on"><st1:City \
w:st="on">Woburn</st1:City>, <st1:State w:st="on">MA</st1:State> <st1:PostalCode \
w:st="on">01801</st1:PostalCode>, <st1:country-region \
w:st="on">USA</st1:country-region></st1:place><br> <a \
href="mailto:a.weiner@valid8.com">a.weiner@valid8.com</a> / Tel:+1-781-938-1221 x112, \
Fax +1-781-207-0550<br> <a href="http://www.VALID8.com">http://www.VALID8.com</a> \
</span></font><font color=navy><span style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New \
Roman";color:navy'> </span></font><o:p></o:p></p>
</div>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt;font-family:"Times New Roman"'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b><span
style='font-weight:bold'>On Behalf Of </span></b>Gianluca Varenni<br>
<b><span style='font-weight:bold'>Sent:</span></b> Tuesday, May 26, 2009 1:22
PM<br>
<b><span style='font-weight:bold'>To:</span></b> winpcap-users@winpcap.org<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users] How
canigetthenew-estpacketfrombuffer?HELPPLEASE~!</span></font><font
face="Times New Roman"><span style='font-family:"Times New \
Roman"'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 face=PMingLiU><span \
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt;font-family:"Times New Roman"'>Sorry for jumping in this conversation
late.</span></font><font face="Times New Roman"><span style='font-family:"Times New \
Roman"'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt;font-family:"Times New Roman"'>Please be aware that WinPcap does *not*
overwrite older packets with new ones. If the kernel buffer (or the user
buffer) is full, newer packets are simply dropped.</span></font><font
face="Times New Roman"><span style='font-family:"Times New \
Roman"'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt;font-family:"Times New Roman"'>Have a nice day</span></font><font
face="Times New Roman"><span style='font-family:"Times New \
Roman"'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt;font-family:"Times New Roman"'>GV</span></font><font
face="Times New Roman"><span style='font-family:"Times New \
Roman"'><o:p></o:p></span></font></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0in 0in 0in \
4.0pt; margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>----- Original Message ----- <o:p></o:p></span></font></p>
</div>
<div style='font-color:black'>
<p class=MsoNormal style='background:#E4E4E4'><b><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial;font-weight:bold'>From:</span></font></b><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> <a
href="mailto:a.weiner@valid8.com" title="a.weiner@valid8.com">Alan Jay Weiner</a>
<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>To:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> <a
href="mailto:winpcap-users@winpcap.org" \
title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a> \
<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>Sent:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Tuesday, May 26, 2009
9:27 AM<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>Subject:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Re:
[Winpcap-users] How can \
igetthenew-estpacketfrombuffer?HELPPLEASE~!<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'><o:p> </o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>I presume the packets contain some kind of
status conditions and you’re doing something based on the latest \
status.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>What about using small buffers? The
older data is overwritten by newer data - if the buffer is only large enough
for 1 or 2 packets, you’ll get the 1 or 2 most-recent packets. All
the other packets will be lost, but that seems ok in your \
situation.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>How many of the most-recent packets do you
need? Is it sufficient to have only the most-recent \
packet?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>- Al Weiner -<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New \
Roman";color:navy'> </span></font><font color=navy><span \
style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>----------------------------------------------------------------------------<br>
Alan Jay Weiner / Valid8.com, Inc. - Conform, Perform & Excel(tm)<br>
500 W Cummings Park, <st1:address w:st="on"><st1:Street w:st="on">Suite \
#</st1:Street>2700</st1:address>, <st1:place w:st="on"><st1:City \
w:st="on">Woburn</st1:City>, <st1:State w:st="on">MA</st1:State> <st1:PostalCode \
w:st="on">01801</st1:PostalCode>, <st1:country-region \
w:st="on">USA</st1:country-region></st1:place><br> <a \
href="mailto:a.weiner@valid8.com">a.weiner@valid8.com</a> / Tel:+1-781-938-1221 x112, \
Fax +1-781-207-0550<br> <a href="http://www.VALID8.com">http://www.VALID8.com</a> \
</span></font><font color=navy><span style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New \
Roman";color:navy'> </span></font><o:p></o:p></p>
</div>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face=PMingLiU><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabIndex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> \
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b><span \
style='font-weight:bold'>On Behalf Of </span></b>rst<br>
<b><span style='font-weight:bold'>Sent:</span></b> Tuesday, May 26, 2009 5:19
AM<br>
<b><span style='font-weight:bold'>To:</span></b> <st1:PersonName \
w:st="on">winpcap-users@winpcap.org</st1:PersonName><br> <b><span \
style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users] How can i \
getthenew-estpacketfrombuffer?HELPPLEASE~!</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face=PMingLiU><span \
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>The
machine always sending packets , never stop.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>and
my computer only connected with the machine (using a crossover network \
cable).</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>so
every packets I get</span></font><font size=2 face="Times New Roman"><span
style='font-size:10.0pt;font-family:"Times New Roman"'> </span></font><font
size=2><span style='font-size:10.0pt'>are what I wanted, but only the newest
packet I need.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>Machine
----(Sending packets)---> My Computer</span></font><font size=2
face="Times New Roman"><span style='font-size:10.0pt;font-family:"Times New \
Roman"'> </span></font><font size=2><span style='font-size:10.0pt'> \
.........................every 0.000005 second</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>My
Application ----(Get the newest packet)---> Get information to do
control...................every 0.0001 second</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>if
the buffer can contrain 10000 packets,</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>0.000005
* 10000 = 0.05 second,</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>so
I can only get the information before 0.05 second,</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>but
in my realtime control, i must get the information less than 0.0001 \
second.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>so
have any ideas?</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>Really
thank you!!</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0in 0in 0in \
4.0pt; margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>If the other machine is sending a constant 200,000 packets
per second and won't slow down, you may be out of luck. However, if the
other machine sends 200,000 packet per second for a short burst (say 10
seconds), then you should be able to store those 2M packets into your own
memory space. After you store the packets, you can do your \
analysis.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>For a quick test, just change your control loop to \
do...</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>static int counter;</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>pcap_next_ex(...);</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>counter++;</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>That is, don't do anything with the packet (other than
advance the buffer and count how many you receive). This will tell you
how fast your machine can move through the buffer.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>If this works well, then you need to do a memcpy() of the
packet into pre-allocated space (i.e. malloc your own circular queue).
This will slow down the loop, but should be much faster than \
0.1ms.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Last question: Most packet capturing applications need
to decode EVERY packet, are you saying that you do NOT need to decode
every packet? If not, how do you know which packets you need to
decode and which ones you don't?</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>DC</span></font><o:p></o:p></p>
</div>
</blockquote>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt;font-family:"Times New Roman"'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New \
Roman"'>_______________________________________________<br> Winpcap-users mailing \
list<br> Winpcap-users@winpcap.org<br>
https://www.winpcap.org/mailman/listinfo/winpcap-users<o:p></o:p></span></font></p>
</blockquote>
</div>
</body>
</html>
_______________________________________________
Winpcap-users mailing list
Winpcap-users@winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic