<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns:o = "urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word"><HEAD>
<META content=text/html;charset=iso-8859-1 http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16490">
<STYLE>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</STYLE>
</HEAD>
<BODY style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; PADDING-TOP: 15px"
id=MailContainerBody lang=EN-US leftMargin=0 link=blue topMargin=0 vLink=purple
CanvasTabStop="true" name="Compose message area">
<DIV><FONT face=Calibri>What kind of network card are you using on the
transmitter machine? can you reproduce it with different network
cards?</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>GV</FONT></DIV>
<DIV style="FONT: 10pt Tahoma">
<DIV><BR></DIV>
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A title=Imre.Magyar@lairdtech.com
href="mailto:Imre.Magyar@lairdtech.com">Imre Magyar</A> </DIV>
<DIV><B>Sent:</B> Friday, April 16, 2010 11:04 AM</DIV>
<DIV><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV><B>Subject:</B> [Winpcap-users] losing transmitted
packets</DIV></DIV></DIV>
<DIV><BR></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">Hello
all,<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">I have a win32 app that calls
pcap_send() in a tight loop repeatedly, on the same 1400 byte frame, say 1000
times.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">The PC is wired directly to an
embedded 10/100 network device, but I do have a port aggregating tap device in
between for monitoring. There are no switches or hubs involved at
all.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">I’ll run the win32 app, and see that
only a small fraction (say 500) of the frames are reported as received on the
device at the other end.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">If I run wireshark on the tap
device, I see that the receiving device reported the frame count accurately.
Only 500 went out on the link.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">If I run wireshark on the PC on the
same interface the app is sending the frames on, I see all 1000
frames.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">If I insert a small delay in the app
between pcap_send() calls (say I call Sleep(1) for a millisecond’s worth of
delay), all 1000 frames go out on the link, albeit much slower than I’d
like.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">Can anyone tell me what is dropping
the frames and why? I’m assuming I’m overrunning some internal transmit buffer
somewhere, but I’m at a loss to understand how to recognize it and when to back
off. The pcap_send() function never returns with an
error.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">Thanks for any
advice,<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=2 face=Arial><SPAN
style="FONT-FAMILY: Arial; FONT-SIZE: 10pt">--Imre
M.<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT size=3 face="Times New Roman"><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BODY></HTML>