[Winpcap-users] WinPCAP packets capture delay..
Black, Michael (IS)
Michael.Black2 at ngc.com
Thu Sep 23 08:56:07 PDT 2010
I see delays in your 10mbit_130byte file
Doing this:\windump -n -ttt -q -r 10mbit_130byte.pcap | cut -f1 -d" " >ttt10.csv
And plotting the results shows a very spikey plot.
Varies from almost 0 to 300+ microseconds.
Average is about 150 microseconds but there are regular excursions to over 200 microseconds.
So you're already seeing delays at 10mbit -- you just never fill up the buffers.
Doing the same plot for 100mbit_130byte shows a first spike to 339us at packet 10143.
There's your "10,000 packets runs OK".
Your 100mbit_640byte first spikes at packet#6733. Bigger packets, earlier slowdown. Then this file shows the average packet delay jumps from 156 to 171 at packet#7142 or so. Then you have regular excursions down to almost 0 for the remaining time and a few excursions to 300+.
The 100mbit_60byte is interesting. 50us average through packet 1371 with lots of 0-excursions. Then the average drops to 38us with fewer excursions to 0, then jumps to a dual-mode 150/160 us delay with regular 0-excursions.
Michael D. Black
Advanced Analytics Directorate
Northrop Grumman Information Systems
From: winpcap-users-bounces at winpcap.org on behalf of Alimjan Kuramshin
Sent: Thu 9/23/2010 10:26 AM
To: winpcap-users at winpcap.org
Subject: EXTERNAL:Re: [Winpcap-users] WinPCAP packets capture delay..
Hello, David! Thanks for Your test and attention.
Okay, I have done some of my own testing with 10,000 packets I am not seeing
any delay at all.
Without 100,000 packets however, I am seeing some periodic delays.
My test is not good. It is not the same test as yours.
I do not have an oscilloscope so I cannot know if the packets are being SENT
without delay. I suspect they are.
I suspect the delay I am seeing with my test is from the SENDING machine,
not on the receiving/capturing machine.
So my test in inconclusive. It proves nothing.
Alimjan, are you absolutely certain there is no delay sending? Does your
oscilloscope have a "record" feature? Can you review your oscilloscope
recording to verify there are zero delays? It is important!
In other words, do you have ABSOLUTE *PROOF* that the packets are being SENT
I've done some test, and here is the results http://www.filefactory.com/file/b39ec4g/n/alimjan_kuramshin_winpcap_test.zip
Can You look at them? May be You can find some thing. Thank You a lot. You are so kind!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 6716 bytes
Desc: not available
Url : http://www.winpcap.org/pipermail/winpcap-users/attachments/20100923/20267c1a/attachment-0001.bin
More information about the Winpcap-users