<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16809" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2>Good luck, as far as I know even the endace cards are not able
to go to 10Gbps full speed in the worst case (small packets), maybe some folk
from Endace can correct me if I'm wrong....</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV> </DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=alessandro@totalwire.it
href="mailto:alessandro@totalwire.it">Alessandro Capucci</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=gianluca.varenni@cacetech.com
href="mailto:gianluca.varenni@cacetech.com">Gianluca Varenni</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Cc:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, April 14, 2009 12:20
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] NPF Device
Driver</DIV>
<DIV><BR></DIV>
<P>10Gb FULL</P>
<P>Alessandro</P>
<P><BR>> <BR>> ----- Original Message ----- <BR>> From: "Alessandro
Capucci" <<A
href="mailto:alessandro@totalwire.it">alessandro@totalwire.it</A>> <BR>>
To: "Gianluca Varenni" <<A
href="mailto:gianluca.varenni@cacetech.com">gianluca.varenni@cacetech.com</A>>
<BR>> Cc: <<A
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>>
<BR>> Sent: Monday, April 13, 2009 12:35 PM <BR>> Subject: Re:
[Winpcap-users] NPF Device Driver <BR>> <BR>> <BR>> Hi, <BR>> I
think to use kernel buffer used percentage to investigate the <BR>>
corretct size to set to the kernel buffer... <BR>> <BR>> BUT.... I begin
to suspect that WinPCap driver is not the good <BR>> solution for try to
investigate 10GBit DPI (deep packet inspection). <BR>> <BR>> I think
that I'll try to develope a NDIS 6.2 protocol driver to <BR>> analize if
exists a possibility to develope a 10GBit DPI using a not <BR>> extreme
expensive device like DAG (quite 30K$) but using intel low <BR>> cost
device (2K$). <BR>> <BR>> Do you think that ther's a possibility to
investigate 10Gbit packet <BR>> with a Win2008 server + NDIS 6.2 protocol
driver and a very good <BR>> server hardware (quad core, ecc... )? <BR>>
<BR>> --GV-- <BR>> I think you will end up with something like winpcap.
Are you looking to <BR>> work <BR>> at full 10Gbps speed or just
4-5Gbps? <BR>> <BR>> Have a nice day <BR>> GV <BR>> <BR>>
<BR>> <BR>> <BR>> <BR>> Tnk for your support, <BR>> Alessandro
<BR>> <BR>> Il giorno 13/apr/09, alle ore 20:22, Gianluca Varenni ha
scritto: <BR>> <BR>>> Answers inline, marked as "--GV--" <BR>>>
<BR>>> Have a nice day <BR>>> GV <BR>>> <BR>>> PS:
please reply to the mailing list as well. <BR>>> <BR>>>
<BR>>> ----- Original Message ----- From: Alessandro Capucci
<BR>>> To: Gianluca Varenni <BR>>> Sent: Saturday, April 11, 2009
5:03 AM <BR>>> Subject: Re: [Winpcap-users] NPF Device Driver
<BR>>> <BR>>> <BR>>> Tnk, I reply to you inline in this mail
in RED. <BR>>> <BR>>> <BR>>> <BR>>> <BR>>> Il
giorno 10/apr/09, alle ore 21:12, Gianluca Varenni ha scritto: <BR>>>
<BR>>> <BR>>> <BR>>> ----- Original Message -----
<BR>>> From: Alessandro Capucci <BR>>> To:
winpcap-users@winpcap.org <BR>>> Sent: Friday, April 10, 2009 3:18 AM
<BR>>> Subject: [Winpcap-users] NPF Device Driver <BR>>>
<BR>>> <BR>>> Hello to every body, <BR>>> I'm new in WinPCap
library... I'm study it for an interesting new <BR>>> project... 10GBit
deep packet inspection. I'm try to connect directly <BR>>> with WinPCap
NPF driver for best performance. All work fine on my 1GBit <BR>>>
adapter! Next week I'll hope to star test with 10GBit adapter. <BR>>>
<BR>>> By "connecting directly to the WinPcap Driver" you mean calling
the <BR>>> Packet API directly? <BR>>> -> YES, I'm connecting
directly to NPF driver via Packet32.c interface <BR>>> (I <BR>>>
haven't use Packet.dll). I'm using Vista, but next week I'll try <BR>>>
Windows <BR>>> Server 2008 to take advantage of NDIS 6.2 and RSS.
<BR>>> <BR>>> --GV-- <BR>>> I wouldn't actually do that.
Unless you modify npf.sys to become an <BR>>> NDIS <BR>>> 6
protocol driver, npf.sys is an NDIS 5 driver. On Vista/2008 NDIS5 is
<BR>>> "emulated" on top of NDIS6 with an adaptation shim. So you might
<BR>>> actually <BR>>> incur into a perf hit. <BR>>> --GV--
<BR>>> <BR>>> I've some question: <BR>>> <BR>>> 0) Do
you think that NPF driver with a good hardware can be able to <BR>>>
capture 10GBit ethernet packet without sensible packet lost ? <BR>>>
<BR>>> No, I don't think so. Capturing at 10Gbps, expecially in the
worst case <BR>>> i.e. 64byte packets, it's an extremely challenging
task. Even custom <BR>>> capture cards (which cost thousands of dollars)
have a very hard time <BR>>> dealing with such an amount of packets.
<BR>>> -> Tnk, i'll try benchmark WinPCap NPF Driver with
generalpurpose <BR>>> ethernet adapter like PCI-Express Intel® 10
Gigabit XF SR Server <BR>>> Adapters <BR>>> (with RSS enabled)
VERSUS an specialized card like DAG by Endace. <BR>>> <BR>>>
<BR>>> 1) Packet.dll functions are callable in multithread applications
? For <BR>>> example can I call PacketReceivePacket or PacketGetStats in
two <BR>>> different concurent thread on the same device ? Are
serialized ? <BR>>> In general the functions are not thread safe when
working on the same <BR>>> LPADAPTER structure. <BR>>> ->Ok
tnk, I'll put it in critical section. <BR>>> <BR>>> --GV--
<BR>>> If performance is your main objective, then putting a critical
section <BR>>> might again hurt performance. I would be careful with
that. <BR>>> <BR>>> --GV-- <BR>>> <BR>>> <BR>>>
2) WinPCap NPF drive is able to take advantage of RSS (Receive Side
<BR>>> Scaling) availble in Win2008 server <BR>>>
(http://msdn.microsoft.com/en-us/library/ms795609.aspx)? <BR>>> No.
<BR>>> ANOTHER QUESTION: <BR>>> Next week I'll try to introduce
another value in the information <BR>>> callback, not only Packet
Received and Packet Dropped but percentage of <BR>>> use of the kernel
circular buffer for CPU. I think that this value <BR>>> could
<BR>>> be usefull to tuning Kernel side buffer size. <BR>>> Do you
think that could be usefull to introduce in your public <BR>>>
distribution? <BR>>> <BR>>> <BR>>> --GV-- <BR>>> How
would you use it? <BR>>> <BR>>> GV <BR>>> <BR>>>
--GV-- <BR>>> <BR>>> <BR>>> <BR>>> <BR>>> Have a
nice day <BR>>> GV <BR>>> <BR>>> <BR>>> Tnk you very
much! <BR>>> Alessandro <BR>>> <BR>>> <BR>>>
<BR>>> <BR>>> <BR>>> <BR>>> <BR>>>
_______________________________________________ <BR>>> Winpcap-users
mailing list <BR>>> Winpcap-users@winpcap.org <BR>>>
https://www.winpcap.org/mailman/listinfo/winpcap-users <BR>> <BR>>
<BR><BR></P></BLOCKQUOTE></BODY></HTML>