<p>10Gb FULL</p>
<p>Alessandro</p>
<p><br />> <br />> ----- Original Message ----- <br />> From:
"Alessandro Capucci" <alessandro@totalwire.it> <br />>
To: "Gianluca Varenni" <gianluca.varenni@cacetech.com> <br
/>> Cc: <winpcap-users@winpcap.org> <br />> Sent: Monday,
April 13, 2009 12:35 PM <br />> Subject: Re: [Winpcap-users] NPF Device
Driver <br />> <br />> <br />> Hi, <br />> I think to use
kernel buffer used percentage to investigate the <br />> corretct size
to set to the kernel buffer... <br />> <br />> BUT.... I begin to
suspect that WinPCap driver is not the good <br />> solution for try to
investigate 10GBit DPI (deep packet inspection). <br />> <br />> I
think that I'll try to develope a NDIS 6.2 protocol driver to <br />>
analize if exists a possibility to develope a 10GBit DPI using a not <br
/>> extreme expensive device like DAG (quite 30K$) but using intel low
<br />> cost device (2K$). <br />> <br />> Do you think that
ther's a possibility to investigate 10Gbit packet <br />> with a
Win2008 server + NDIS 6.2 protocol driver and a very good <br />>
server hardware (quad core, ecc... )? <br />> <br />> --GV-- <br
/>> I think you will end up with something like winpcap. Are you
looking to <br />> work <br />> at full 10Gbps speed or just
4-5Gbps? <br />> <br />> Have a nice day <br />> GV <br />>
<br />> <br />> <br />> <br />> <br />> Tnk for your
support, <br />> Alessandro <br />> <br />> Il giorno 13/apr/09,
alle ore 20:22, Gianluca Varenni ha scritto: <br />> <br />>>
Answers inline, marked as "--GV--" <br />>> <br />>>
Have a nice day <br />>> GV <br />>> <br />>> PS: please
reply to the mailing list as well. <br />>> <br />>> <br
/>>> ----- Original Message ----- From: Alessandro Capucci <br
/>>> To: Gianluca Varenni <br />>> Sent: Saturday, April 11,
2009 5:03 AM <br />>> Subject: Re: [Winpcap-users] NPF Device Driver
<br />>> <br />>> <br />>> Tnk, I reply to you inline in
this mail in RED. <br />>> <br />>> <br />>> <br
/>>> <br />>> Il giorno 10/apr/09, alle ore 21:12, Gianluca
Varenni ha scritto: <br />>> <br />>> <br />>> <br
/>>> ----- Original Message ----- <br />>> From: Alessandro
Capucci <br />>> To: winpcap-users@winpcap.org <br />>> Sent:
Friday, April 10, 2009 3:18 AM <br />>> Subject: [Winpcap-users] NPF
Device Driver <br />>> <br />>> <br />>> Hello to every
body, <br />>> I'm new in WinPCap library... I'm study it for an
interesting new <br />>> project... 10GBit deep packet inspection.
I'm try to connect directly <br />>> with WinPCap NPF driver for
best performance. All work fine on my 1GBit <br />>> adapter! Next
week I'll hope to star test with 10GBit adapter. <br />>> <br
/>>> By "connecting directly to the WinPcap Driver" you
mean calling the <br />>> Packet API directly? <br />>> ->
YES, I'm connecting directly to NPF driver via Packet32.c interface <br
/>>> (I <br />>> haven't use Packet.dll). I'm using Vista, but
next week I'll try <br />>> Windows <br />>> Server 2008 to
take advantage of NDIS 6.2 and RSS. <br />>> <br />>> --GV--
<br />>> I wouldn't actually do that. Unless you modify npf.sys to
become an <br />>> NDIS <br />>> 6 protocol driver, npf.sys is
an NDIS 5 driver. On Vista/2008 NDIS5 is <br />>>
"emulated" on top of NDIS6 with an adaptation shim. So you might
<br />>> actually <br />>> incur into a perf hit. <br
/>>> --GV-- <br />>> <br />>> I've some question: <br
/>>> <br />>> 0) Do you think that NPF driver with a good
hardware can be able to <br />>> capture 10GBit ethernet packet
without sensible packet lost ? <br />>> <br />>> No, I don't
think so. Capturing at 10Gbps, expecially in the worst case <br />>>
i.e. 64byte packets, it's an extremely challenging task. Even custom <br
/>>> capture cards (which cost thousands of dollars) have a very
hard time <br />>> dealing with such an amount of packets. <br
/>>> -> Tnk, i'll try benchmark WinPCap NPF Driver with
generalpurpose <br />>> ethernet adapter like PCI-Express Intel®
10 Gigabit XF SR Server <br />>> Adapters <br />>> (with RSS
enabled) VERSUS an specialized card like DAG by Endace. <br />>> <br
/>>> <br />>> 1) Packet.dll functions are callable in
multithread applications ? For <br />>> example can I call
PacketReceivePacket or PacketGetStats in two <br />>> different
concurent thread on the same device ? Are serialized ? <br />>> In
general the functions are not thread safe when working on the same <br
/>>> LPADAPTER structure. <br />>> ->Ok tnk, I'll put it in
critical section. <br />>> <br />>> --GV-- <br />>> If
performance is your main objective, then putting a critical section <br
/>>> might again hurt performance. I would be careful with that. <br
/>>> <br />>> --GV-- <br />>> <br />>> <br
/>>> 2) WinPCap NPF drive is able to take advantage of RSS (Receive
Side <br />>> Scaling) availble in Win2008 server <br />>>
(http://msdn.microsoft.com/en-us/library/ms795609.aspx)? <br />>>
No. <br />>> ANOTHER QUESTION: <br />>> Next week I'll try to
introduce another value in the information <br />>> callback, not
only Packet Received and Packet Dropped but percentage of <br />>>
use of the kernel circular buffer for CPU. I think that this value <br
/>>> could <br />>> be usefull to tuning Kernel side buffer
size. <br />>> Do you think that could be usefull to introduce in
your public <br />>> distribution? <br />>> <br />>> <br
/>>> --GV-- <br />>> How would you use it? <br />>> <br
/>>> GV <br />>> <br />>> --GV-- <br />>> <br
/>>> <br />>> <br />>> <br />>> Have a nice day
<br />>> GV <br />>> <br />>> <br />>> Tnk you
very much! <br />>> Alessandro <br />>> <br />>> <br
/>>> <br />>> <br />>> <br />>> <br />>> <br
/>>> _______________________________________________ <br />>>
Winpcap-users mailing list <br />>> Winpcap-users@winpcap.org <br
/>>> https://www.winpcap.org/mailman/listinfo/winpcap-users <br
/>> <br />> <br /><br /></p>