<br><font size=2 face="sans-serif">thank you for the answer. there are
two questions :</font>
<br>
<br><font size=2 face="sans-serif">1. </font><font size=2 face="Calibri">
is it possible to copy data directly from the kernel buffer to the final
buffer ( which I want the date kept in) ? </font>
<br><font size=2 face="sans-serif">2. or is there any way that programmer
can modify the address of the user buffer directly? </font>
<br>
<br><font size=2 face="sans-serif">thank you.</font>
<br><font size=2 face="sans-serif"><br>
</font>
<br>
<br><font size=2 face="sans-serif">Yulou</font>
<br>
<br>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=35%><font size=1 face="sans-serif"><b>"Gianluca Varenni"
<gianluca.varenni@cacetech.com></b> </font>
<br><font size=1 face="sans-serif">发件人: winpcap-users-bounces@winpcap.org</font>
<p><font size=1 face="sans-serif">2010-09-21 07:45</font>
<table border>
<tr valign=top>
<td bgcolor=white>
<div align=center><font size=1 face="sans-serif">请答复 给<br>
winpcap-users@winpcap.org</font></div></table>
<br>
<td width=64%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">收件人</font></div>
<td><font size=1 face="sans-serif"><winpcap-users@winpcap.org></font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">抄送</font></div>
<td>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">主题</font></div>
<td><font size=1 face="sans-serif">Re: [Winpcap-users] About the packets
loss , what is the bottleneck ?</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=3 face="Calibri">Two notes: </font>
<br><font size=3> </font>
<br><font size=3 face="Calibri">1. if the objective is dumping the packets
to disk, then the bottleneck is mostly the disk. </font>
<br><font size=3 face="Calibri">2. checksum offloading does not play any
role in packet capture. It plays a role when packets have to be processed
by the TCP/IP stack (because the validation is done in hardware rather
software). But when you do packet capture, you don't care about that. In
fact I suggested to totally disable TCP/IP from the NIC where you capture
the packets from.</font>
<br><font size=3> </font>
<br><font size=3 face="Calibri">GV</font>
<br>
<br><font size=3><b>From:</b> </font><a href=mailto:fish@infidels.org><font size=3 color=blue><u>"Fish"
(David B. Trout)</u></font></a><font size=3> </font>
<br><font size=3><b>Sent:</b> Sunday, September 19, 2010 4:44 AM</font>
<br><font size=3><b>To:</b> </font><a href="mailto:winpcap-users@winpcap.org"><font size=3 color=blue><u>winpcap-users@winpcap.org</u></font></a><font size=3>
</font>
<br><font size=3><b>Subject:</b> Re: [Winpcap-users] About the packets
loss ,what is the bottleneck ?</font>
<br>
<br><font size=2 color=#1f497d face="Calibri">There are other factors as
well:</font>
<br><font size=2 color=#1f497d face="Calibri"> </font>
<br><font size=2 color=#1f497d face="Calibri">1. Number
of processors and processor speed.</font>
<br><font size=2 color=#1f497d face="Calibri">2. Amount
of RAM</font>
<br><font size=2 color=#1f497d face="Calibri">3. Operating
system workload</font>
<br><font size=2 color=#1f497d face="Calibri">4. Network
Adapter Task Offloading capability (esp. checksum offloading)</font>
<br><font size=2 color=#1f497d face="Calibri">5. Speed
of disk subsystem</font>
<br><font size=2 color=#1f497d face="Calibri"> </font>
<br><font size=2 color=#1f497d face="Calibri">On an modern fast quad-core
system that is relatively idle (has no other work to do) with lots of RAM
and a high performance multi-disk RAID-0 array and with checksum offloading
enabled in the adapter, it should be entirely possible to capture a gigabit
speed without packet loss.</font>
<br><font size=2 color=#1f497d face="Calibri"> </font>
<br><font size=2 color=#1f497d face="Calibri">If your system is an overtaxed
(busy) single processor system with only an average amount of RAM and an
average speed non-RAID disk subsystem however, then you’re very likely
going to experience significant packet loss beyond about 480 Mbps.</font>
<br><font size=1 face="Arial">-- </font><font size=4 face="Arial"><br>
"</font><font size=3 color=#008000 face="Arial"><b>Fish</b></font><font size=4 face="Arial">"</font><font size=2 face="Arial">
(</font><font size=2 color=#800080 face="Comic Sans MS">David B.
Trout</font><font size=2 color=#1f497d face="Arial">)</font><font size=3 color=#1f497d face="Times New Roman">
</font><font size=2 color=#1f497d face="Verdana"><br>
</font><font size=3 color=#1f497d face="Times New Roman"> </font><font size=2 color=blue face="Arial"><u>fish@softdevlabs.com</u></font>
<br><font size=2 color=#1f497d face="Calibri"> </font>
<br><font size=2 face="Tahoma"><b>From:</b> winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] <b>On Behalf Of </b>yulou liu<b><br>
Sent:</b> Sunday, September 19, 2010 12:50 AM<b><br>
To:</b> winpcap-users@winpcap.org<b><br>
Subject:</b> [Winpcap-users] About the packets loss , what is the bottleneck
?<b><br>
Importance:</b> High</font>
<br><font size=3 face="Times New Roman"> </font>
<br><font size=2 face="Calibri"><br>
There is still the question about packets loss.<br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
According to the essay ' </font><font size=2>Profiling and Optimization
of Software-Based Network-Analysis Applications</font><font size=2 face="Calibri">'
, every packet is copied twice in the main memory before reaching
the user. In order to reduce the cost of CPU and the bus occupying
of the SDRAM of pc, is it possible to copy data directly from the
kernel buffer to the final buffer , which I want the date kept in
? <br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
Here is another idea --- </font><font size=2> allocate several different
user buffers , once </font><font size=2 face="Calibri">a </font><font size=2>user
buffer is fulled , then let the next user buffer to save the </font><font size=2 face="Calibri">new</font><font size=2>
datas from kernel buffer. Meanwhile copy datas from the first user
buffer to disk (assume that the hard disk write rate is fast enough).</font><font size=2 face="Calibri">
Is this idea work with the winpcap ?</font><font size=3 face="Times New Roman">
</font><font size=2 face="Calibri"><br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
Thank you!</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
</font><font size=3 face="Times New Roman"> </font><font size=2 face="Calibri"><br>
==============================================================</font><font size=3 face="Times New Roman">
</font><font size=2 face="Calibri"><br>
</font><font size=3 face="Times New Roman"> </font><font size=2><br>
Q1: tough question to answer, as it depends on a number of factors. What
is the average packet size? Are you just counting the packets, or dumping
them to disk/DB/...? Do you see packet drops in the pcap_stats?<br>
Q2: I will need to run some tests on this. Do you have some minimal sample
code that shows the issue?<br>
Q3: Yes, *if* the NIC (and NIC driver) are not dropping packets themselves.
<br>
<br>
Did you disable any protocol bound to the NIC where you receive all these
packets?<br>
<br>
Have a nice day<br>
GV<br>
<br>
<br>
<br>
<br>
From: yulou liu <br>
Sent: Wednesday, August 25, 2010 11:08 AM<br>
To: winpcap <br>
Subject: [Winpcap-users] About the packets loss , what is the bottleneck
?<br>
<br>
<br>
I'm using winpcap to capture datas from FPGA board via 1G Ethernet connection(directly
connected).<br>
the FPGA is configed to send data at a special rate. With the fpga sending
rate increases,especially above 500Mbps, it sometimes loss packets.
<br>
<br>
Q1: Is it possible to totally avoid packets loss by optimism the
code? I want to collect datas at speed 614Mbps without packet loss
(collecting all datas <br>
<br>
last about 1 minutes). My workstations features with 2 Xeon CPU (each has
4core), DDR3 SDRAM, 1 G onboard netcard. Which part is the
most probably bottleneck ?<br>
<br>
Q2: As a test , I found the pcap_next_ex() can't get any packets
when the user buffer is set over 64 MB, what does it happen
?<br>
<br>
Q3: if the Kernel buffer's size is 16MB , then the first 16Mb packets from
fpga won't be lost, so , if I set the kernel buffer as 128MB
, then at least <br>
<br>
the first coming 128MB data from FPGA won't be lost either ? but
I found When I set the kernel buffer bigger than 100 MB, the packets drops
is getting <br>
<br>
worse. <br>
<br>
<br>
Thanks a lot!<br>
</font>
<br><font size=2 face="Courier New"> </font>
<p>
<hr>
<p><font size=3>_______________________________________________<br>
Winpcap-users mailing list<br>
Winpcap-users@winpcap.org<br>
https://www.winpcap.org/mailman/listinfo/winpcap-users</font><font size=2><tt>_______________________________________________<br>
Winpcap-users mailing list<br>
Winpcap-users@winpcap.org<br>
https://www.winpcap.org/mailman/listinfo/winpcap-users<br>
</tt></font>
<p>
<br><pre>
--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.
This message has been scanned for viruses and Spam by ZTE Anti-Spam system.
</pre>