<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=utf-8">
<META content="MSHTML 6.00.2900.5726" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=boaz.brickner@gmail.com href="mailto:boaz.brickner@gmail.com">Boaz
Brickner</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Thursday, July 02, 2009 9:55
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] Problem
gathering bytes statistics on Ethernetdevices</DIV>
<DIV><FONT face="Courier New" size=2></FONT><BR></DIV>
<DIV dir=ltr>Hi,<BR><BR>I'm using Windows XP Professional SP3 with Atheros
AR8121/AR8113 PCI-E Ethernet Controller.<BR><BR>I'm following the statistics
part of the tutorial: <A
href="http://www.winpcap.org/docs/docs_40_2/html/group__wpcap__tut9.html">http://www.winpcap.org/docs/docs_40_2/html/group__wpcap__tut9.html</A><BR><BR>I'm
sniffing the packets I'm sending and I'm sending a batch of Ethernet packets
to my Ethernet device.<BR>If I send N packets with size 60 or greater, I'm
receiving all the N packets using the statistics mode.<BR>However, when I look
at the "AcceptedBytes" field according to the winpcap tutorial, I'm receiving
exactly 12 bytes more per packet sent.<BR></DIV></BLOCKQUOTE>
<DIV><FONT face="Courier New" size=2>What if you capture the packets that you
transmit (e.g. with Wireshark) instead of using the statistics mode? Do the
packets appear ok in this case?</FONT></DIV>
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<DIV><FONT face="Courier New" size=2>Have a nice day</FONT></DIV>
<DIV><FONT face="Courier New" size=2>GV</FONT></DIV><FONT face="Courier New"
size=2></FONT>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV dir=ltr>Example: If I send 10 packets of 60 bytes, I receive in the
statistics mode 10 packets and 720 bytes (instead of 600).<BR>Example: If I
send 100 packets of 500 bytes, I receive in the statistics mode 100 packets
and 51,200 bytes (instead of 50,000).<BR><BR>My guess is that it has something
to do with the Ethernet Preamble / Start-of-Frame-Delimiter / Interframe gap
fields of the Ethernet protocol since these fields are not part of the sniffed
(or sent) packet.<BR>I'm not sure exactly why these 12 bytes are added to the
statistics and would like to know for statistics analysis.<BR><BR>By the way,
if I send packets with less than 60 bytes. The difference I receive per packet
is 12 bytes + the number of bytes complementing to 60 bytes. This is obvious
since the minimum Ethernet packet size is 60 bytes.<BR><BR>Example: If I send
100 packets of 25 bytes, I receive in the statistics mode 100 packets and
7,200 bytes (and not 2,500).<BR><BR>Thank you,<BR><BR>Boaz.<BR></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>