<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:blue;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=SL link=blue vlink=blue>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Boaz: it needs .Net 3.5<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Thank you anyway<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span lang=EN-US
style='font-size:10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma'>
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b><span
style='font-weight:bold'>On Behalf Of </span></b>Boaz Brickner<br>
<b><span style='font-weight:bold'>Sent:</span></b> Monday, April 12, 2010 10:23
PM<br>
<b><span style='font-weight:bold'>To:</span></b> winpcap-users@winpcap.org<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users]
Statistical mode help</span></font><span lang=EN-US><o:p></o:p></span></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>Have you tried Pcap.Net?<br>
<a href="http://pcapdotnet.codeplex.com">http://pcapdotnet.codeplex.com</a><br>
<br>
Boaz.<o:p></o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>On Mon, Apr 12, 2010 at 23:06, pro2c <<a
href="mailto:pro2c@litrca.com">pro2c@litrca.com</a>> wrote:<o:p></o:p></span></font></p>
<div link=blue vlink=purple name="Compose message area">
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'>No, I didn't write the wrapper. But this is the only one for .NET
2.0 (sharppcap) </span></font><font size=2 color=navy face=Wingdings><span
style='font-size:10.0pt;font-family:Wingdings;color:navy'>L</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'> </span></font><o:p></o:p></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma;
font-weight:bold'>From:</span></font></b><font size=2 face=Tahoma><span
lang=EN-US style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>
[mailto:<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>]
<b><span style='font-weight:bold'>On Behalf Of </span></b>Gianluca Varenni<o:p></o:p></span></font></p>
<div>
<div>
<p class=MsoNormal><font size=2 face=Tahoma><span lang=EN-US style='font-size:
10.0pt;font-family:Tahoma'><br>
<b><span style='font-weight:bold'>Sent:</span></b> Monday, April 12, 2010 9:50
PM<br>
<b><span style='font-weight:bold'>To:</span></b> <a
href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users]
Statistical mode help<o:p></o:p></span></font></p>
</div>
</div>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>The
reason is probably in the .NET wrapper itself, then. Opening around 100
pcap instances is something that I've never tried, but it might definitely
impact the overall system performance.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>If you
have written the .NET wrapper yourself, I would look into optimizing its code.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>Have a
nice day</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>GV</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> </span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:pro2c@litrca.com" target="_blank" title="pro2c@litrca.com">pro2c</a>
</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Sent:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Monday,
April 12, 2010 12:40 PM</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>To:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users@winpcap.org" target="_blank"
title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Subject:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Re:
[Winpcap-users] Statistical mode help</span></font><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'>I'm doing this in <a href="http://VB.NET" target="_blank">VB.NET</a>
2005 (.NET 2.0) and with 1,5Mbyte/sec (~3000 packets/sec) the cpu load is
very high.</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'> </span></font><o:p></o:p></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma;
font-weight:bold'>From:</span></font></b><font size=2 face=Tahoma><span
lang=EN-US style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>
[mailto:<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>]
<b><span style='font-weight:bold'>On Behalf Of </span></b>Gianluca Varenni<br>
<b><span style='font-weight:bold'>Sent:</span></b> Monday, April 12, 2010 9:31
PM<br>
<b><span style='font-weight:bold'>To:</span></b> <a
href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users]
Statistical mode help</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>Then you
should definitely be able to process that amount of packets with a simple user
mode application that sorts the packets by TCP port.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>Have a
nice day</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>GV</span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> </span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:pro2c@litrca.com" target="_blank" title="pro2c@litrca.com">pro2c</a>
</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Sent:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Monday,
April 12, 2010 12:15 PM</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>To:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users@winpcap.org" target="_blank"
title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Subject:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Re:
[Winpcap-users] Statistical mode help</span></font><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'>Not much. Traffic of an average computer... about 15Mbit down and
15 up</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'> </span></font><o:p></o:p></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma;
font-weight:bold'>From:</span></font></b><font size=2 face=Tahoma><span
lang=EN-US style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>
[mailto:<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>]
<b><span style='font-weight:bold'>On Behalf Of </span></b>Gianluca Varenni<br>
<b><span style='font-weight:bold'>Sent:</span></b> Monday, April 12, 2010 9:02
PM<br>
<b><span style='font-weight:bold'>To:</span></b> <a
href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users]
Statistical mode help</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>How much
traffic are we talking about? </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>Have a
nice day</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>GV</span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> </span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:pro2c@litrca.com" target="_blank" title="pro2c@litrca.com">pro2c</a>
</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Sent:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Monday,
April 12, 2010 11:55 AM</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>To:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users@winpcap.org" target="_blank"
title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Subject:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Re: [Winpcap-users]
Statistical mode help</span></font><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'>I already did this (capture all packets and sorted them on their
ports) but it was too slow when downloading at full speed. So I turned to
statistics as I only need the bytes up/down per port. </span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'>There are about 100 active ports on average, so 100 instances would
be neccessary...</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'> </span></font><o:p></o:p></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma;
font-weight:bold'>From:</span></font></b><font size=2 face=Tahoma><span
lang=EN-US style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>
[mailto:<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>]
<b><span style='font-weight:bold'>On Behalf Of </span></b>Gianluca Varenni<br>
<b><span style='font-weight:bold'>Sent:</span></b> Monday, April 12, 2010 8:50
PM<br>
<b><span style='font-weight:bold'>To:</span></b> <a
href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users] Statistical
mode help</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>It
depends on the number of instances. For sure I wouldn't open 64k instances to
monitor all the ports. I would capture all the packets (i.e. no statistics
mode) and write my own code to disssect the packets and compute the statistics.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>GV</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> </span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:pro2c@litrca.com" target="_blank" title="pro2c@litrca.com">pro2c</a>
</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Sent:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Monday,
April 12, 2010 11:42 AM</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>To:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users@winpcap.org" target="_blank"
title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Subject:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Re:
[Winpcap-users] Statistical mode help</span></font><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'>Thank you for your reply!</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'> </span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'>One more question: are several instances heavy on the cpu?...can I
monitor all the computer's ports without stressing the cpu too much?</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 color=navy face=Arial><span style='font-size:10.0pt;font-family:Arial;
color:navy'> </span></font><o:p></o:p></p>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b><font
size=2 face=Tahoma><span lang=EN-US style='font-size:10.0pt;font-family:Tahoma;
font-weight:bold'>From:</span></font></b><font size=2 face=Tahoma><span
lang=EN-US style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>
[mailto:<a href="mailto:winpcap-users-bounces@winpcap.org" target="_blank">winpcap-users-bounces@winpcap.org</a>]
<b><span style='font-weight:bold'>On Behalf Of </span></b>Gianluca Varenni<br>
<b><span style='font-weight:bold'>Sent:</span></b> Monday, April 12, 2010 8:37
PM<br>
<b><span style='font-weight:bold'>To:</span></b> <a
href="mailto:winpcap-users@winpcap.org" target="_blank">winpcap-users@winpcap.org</a><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users]
Statistical mode help</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>you need
to use several instances.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>Have a
nice day</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face=Calibri><span style='font-size:12.0pt;font-family:Calibri'>GV</span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> </span></font><o:p></o:p></p>
</div>
<div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>From:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:pro2c@litrca.com" target="_blank" title="pro2c@litrca.com">pro2c</a>
</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Sent:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> Monday,
April 12, 2010 11:24 AM</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>To:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> <a
href="mailto:winpcap-users@winpcap.org" target="_blank"
title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;
background:whitesmoke;background-attachment:scroll;background-position-x:0%;
background-position-y:0%'><b><font size=2 face=Tahoma><span style='font-size:
10.0pt;font-family:Tahoma;font-weight:bold'>Subject:</span></font></b><font
size=2 face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> [Winpcap-users]
Statistical mode help</span></font><o:p></o:p></p>
</div>
</div>
</div>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'> <o:p></o:p></span></font></p>
</div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Hello</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>I've set the
stats filter to monitor several tcp ports. I recieve only the data for all
these ports together and I wish to be able to get the individual data for each
port. Is this possible with 1 instance or do I have to create one instance of
winpcap for every port?</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> </span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Thanx</span></font><o:p></o:p></p>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>Michael</span></font><o:p></o:p></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><o:p></o:p></span></font></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><o:p></o:p></span></font></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><o:p></o:p></span></font></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><o:p></o:p></span></font></p>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><font
size=3 face="Times New Roman"><span style='font-size:12.0pt'>_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org" target="_blank">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><o:p></o:p></span></font></p>
</div>
</div>
</div>
</div>
<p class=MsoNormal style='margin-bottom:12.0pt'><font size=3
face="Times New Roman"><span style='font-size:12.0pt'><br>
_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</div>
</body>
</html>