<html>
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Fixedsys;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.emailstyle17
{font-family:Arial;
color:windowtext;}
span.emailstyle20
{font-family:Arial;
color:navy;}
span.EmailStyle21
{font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>We finally caught the error. We did
not get the Task Manager screen shot. Also you are correct in that
serializing the initialization did not help.</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>One thing interesting, we have two threads
per NIC card setting different buffer sizes. The first allocation worked
and the second did not. The bracketed number is the thread id.</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>05/29 14:24:54.53 Interface.cpp:93:
[00001A54] Set buffer size to 1048576 for interface
\Device\NPF_{F4E3EFD7-CAB0-481B-86E3-874358548A34} : Signaling Interface</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>05/29 14:24:54.53 Interface.cpp:85:
[00001174] Could not set buffer size to 5242880 for interface
\Device\NPF_{F4E3EFD7-CAB0-481B-86E3-874358548A34}: driver error: not enough
memory to allocate the kernel buffer</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<div>
<p class=MsoNormal><strong><b><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Ed Sassone</span></font></b></strong></p>
<p class=MsoNormal><font size=1 color=navy face=Arial><span style='font-size:
7.5pt;font-family:Arial;color:navy'><a href="http://www.autonomy.com/">www.autonomy.com</a></span></font></p>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;color:navy'> </span></font></p>
<p class=MsoNormal><b><font size=1 color=navy face=Arial><span
style='font-size:8.0pt;font-family:Arial;color:navy;font-weight:bold'>CONFIDENTIALITY
NOTICE: This communication and any files or attachments transmitted with it
contain information that is confidential to the sender and/or Autonomy, Inc.,
privileged or exempt from disclosure under applicable law. It is intended
solely for the use of the individual or the entity to which it is addressed. If
you are not the intended recipient(s), you are hereby notified that any use,
dissemination, or copying of this communication is strictly prohibited; please
do not read, copy, use or disclose the content of this communication to others.
If you have received this communication in error, please delete it and contact
our network administrator at (214) 981-3100. Thank you.</span></font></b></p>
</div>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b><span
style='font-weight:bold'>On Behalf Of </span></b>Sassone, Ed<br>
<b><span style='font-weight:bold'>Sent:</span></b> Wednesday, October 08, 2008
3:12 PM<br>
<b><span style='font-weight:bold'>To:</span></b> winpcap-users@winpcap.org<br>
<b><span style='font-weight:bold'>Subject:</span></b> RE: [Winpcap-users]
pcap_setbuff occasional failure</span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Essentially a critical section around all
the adapter initialization calls so it will only be in one set a time, across
all threads and adapters. Unfortunately I didn’t have it print the
pcap_geterr string. I just put that in. It may be awhile until we
catch it in the act.</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>thanks</span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'> </span></font></p>
<div>
<p class=MsoNormal><strong><b><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Ed Sassone</span></font></b></strong></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b><span
style='font-weight:bold'>On Behalf Of </span></b>Gianluca Varenni<br>
<b><span style='font-weight:bold'>Sent:</span></b> Wednesday, October 08, 2008
2:05 PM<br>
<b><span style='font-weight:bold'>To:</span></b> winpcap-users@winpcap.org<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users]
pcap_setbuff occasional failure</span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt'>Serializing pcap_setbuff should not be necessary (serializing against
what? multiple calls on the same adapter? on the same pcap_t handle?).</span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt'>Expecially considering that the only solution is a reboot, I would
think that there is some sort of leak either in the WinPcap driver or in some
other driver in the system. What's the exact error message returned by
pcap_setbuff?</span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt'>Also, after the problem occurs and before rebooting, open Task Manager,
go to the Performance Tab and send me a screenshot of it, if possible.</span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt'>Have a nice day</span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt'>GV</span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0in 0in 0in 4.0pt;
margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>----- Original Message ----- </span></font></p>
</div>
<div style='font-color:black'>
<p class=MsoNormal style='background:#E4E4E4'><b><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial;font-weight:bold'>From:</span></font></b><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> <a
href="mailto:Ed.Sassone@autonomy.com" title="Ed.Sassone@autonomy.com">Sassone,
Ed</a> </span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>To:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> <a
href="mailto:winpcap-users@winpcap.org" title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>
</span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>Sent:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Monday, October
06, 2008 2:15 PM</span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>Subject:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> [Winpcap-users]
pcap_setbuff occasional failure</span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
</div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hi</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Every so often in our application during startup, the pcap</span></font><font
size=2 face=Fixedsys><span style='font-size:10.0pt;font-family:Fixedsys'>_</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>setbuff call
will fail. We are unable to re-create the problem but it seems to happen
after the application has been stopped and started a number of times.
Once the failure occurs it will continue to occur, until a reboot. Our
app is multithreaded with two threads starting per interface card, and we can
have more than one interface card configured. The buffer size specified
can vary but it’s usually around 5-10 MB. I have recently put in
some changes to serialize the command in case there is a timing issue, as
I’m not sure if the call is thread safe. I remember there was
thread issue with the filter command. This is on Windows 2003. Any
other ideas? </span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>thanks</span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
<p class=MsoNormal><strong><b><font size=2 color=navy face=Arial><span
style='font-size:10.0pt;font-family:Arial;color:navy'>Ed Sassone</span></font></b></strong></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'> </span></font></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>_______________________________________________<br>
Winpcap-users mailing list<br>
Winpcap-users@winpcap.org<br>
https://www.winpcap.org/mailman/listinfo/winpcap-users</span></font></p>
</blockquote>
</div>
</body>
</html>