<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16544" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>The timestamp is generated when the stat reports are
computed in the driver.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>While in the callback function, the packets are buffered by
the kernel buffer managed by the WinPcap kernel driver, npf.sys. In particular,
if you are in statistical mode, packets are not actually buffered at all, the
driver receives the packets from the OS, updates the statistics and releases the
packet. This update is completely independent from the callback
function.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=Jonathan.Fitt@anritsu.com
href="mailto:Jonathan.Fitt@anritsu.com">Fitt, Jonathan</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Thursday, December 06, 2007 2:11
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] MODE_STAT</DIV>
<DIV><BR></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>My question is
about using pcap in statistical mode.</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>The timeval
attached to the stat report header, when exactly is that
time?</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>Is it the time the
capture started, or timed out?</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>Also, while in the
callback function are all packets received/sent buffered up so that they'll
appear in the next report?</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>I don't want to
miss any while in the callback function.</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2>Thanks,</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2>Jonathan</FONT></SPAN></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>