<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=big5">
<META content="MSHTML 6.00.6000.16825" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>If the other machine is sending a constant 200,000
packets per second and won't slow down, you may be out of luck. However,
if the other machine sends 200,000 packet per second for a short burst (say 10
seconds), then you should be able to store those 2M packets into your own memory
space. After you store the packets, you can do your analysis.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>For a quick test, just change your control loop to
do...</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>static int counter;</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>pcap_next_ex(...);</FONT></DIV>
<DIV><FONT face=Arial size=2>counter++;</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>That is, don't do anything with the packet (other
than advance the buffer and count how many you receive). This will tell
you how fast your machine can move through the buffer.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>If this works well, then you need to do a memcpy()
of the packet into pre-allocated space (i.e. malloc your own circular
queue). This will slow down the loop, but should be much faster than
0.1ms.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Last question: Most packet capturing
applications need to decode EVERY packet, are you saying that you do NOT need to
decode every packet? If not, how do you know which packets you need
to decode and which ones you don't?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>DC</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=slash@realscene.com.tw href="mailto:slash@realscene.com.tw">rst</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, May 25, 2009 11:31 PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] How can i
get the new-estpacketfrombuffer?HELPPLEASE~!</DIV>
<DIV><BR></DIV>
<DIV><FONT size=2>There is a machine, It send packets to my application ,
</FONT><FONT size=2>and the speed is fixed </FONT></DIV>
<DIV><FONT size=2>(about 200000 packets/per second = 0.000005 second for a
packet),</FONT></DIV>
<DIV><FONT size=2>the packet include some informations, my application need
the informations to do realtime control.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>my application need 0.0001 second (0.1 ms) to finish a
control loop,</FONT></DIV>
<DIV><FONT size=2>when the application doing control, it need
"current" information.</FONT></DIV>
<DIV><FONT size=2>but because the buffer, I always got the oldest information
in buffer,</FONT></DIV>
<DIV><FONT size=2>so i can't do the realtime control.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Does any function can clear buffer?</FONT></DIV>
<DIV><FONT size=2>or decrease the buffer size ?</FONT></DIV>
<DIV><FONT size=2>or stop capture packet for awhile ( let the incoming packets
drops immediacy, don't fill into buffer )?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>another question, how large is the buffer size?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV>----- Original Message ----- </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt 新細明體; font-color: black"><B>From:</B>
<A title=dchang@fsautomation.com href="mailto:dchang@fsautomation.com">David
Chang</A> </DIV>
<DIV style="FONT: 10pt 新細明體"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt 新細明體"><B>Sent:</B> Tuesday, May 26, 2009 1:59
PM</DIV>
<DIV style="FONT: 10pt 新細明體"><B>Subject:</B> Re: [Winpcap-users] How can i
get the new-est packetfrombuffer?HELPPLEASE~!</DIV>
<DIV><BR></DIV>
<DIV><FONT face=Arial size=2>I don't think there is a way to get to the
front of the queue to get the latest packet. You have to sequentially
read through the queue.</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>Can you explain what your application is
doing? When you say you want the newest packet, what does that mean
(i.e. each packet received is the newest packet at that moment in
time)?</FONT></DIV>
<DIV><FONT face=Arial size=2></FONT> </DIV>
<DIV><FONT face=Arial size=2>DC</FONT></DIV></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>