<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=text/html;charset=utf-8 http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16625"></HEAD>
<BODY style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; PADDING-TOP: 15px"
id=MailContainerBody leftMargin=0 topMargin=0 bgColor=#ffffff text=#000000
CanvasTabStop="true" name="Compose message area">
<DIV><FONT face=Calibri>1. If you really want, you can switch to RDTSC in this
way by modifying/adding a registry key</FONT></DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span></SPAN> </DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span>
HKLM\System\CurrentControlSet\Services\NPF\TimestampMode<BR> Possible
values are<BR> * 0 (default) -> Timestamps generated through
KeQueryPerformanceCounter,<BR>
less reliable on SMP/HyperThreading
machines,<BR> precision =
some microseconds<BR> * 2 -> Timestamps generated through
KeQuerySystemTime,<BR> more reliable on SMP/HyperThreading
machines,<BR> precision =
scheduling quantum (10/15 ms)<BR> * 3 -> Timestamps generated
through the i386 instruction
RDTSC,<BR> less reliable
on SMP/HyperThreading/SpeedStep
machines,<BR> precision =
some microseconds<BR></SPAN></DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri>My 6th sense tells me that you
won't see any change in performance.</FONT></SPAN></DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri></FONT></SPAN> </DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri>2. Usage of kernel buffer: at
the moment is not available (it could be added by modifying the driver).
However, if the problem is the kernel buffer, the dropped packet count would not
be zero. And it's my understanding that this counter is always zero in your
case, right?</FONT></SPAN></DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri> no of frames
copied per DPC and served per interrupt. This information is simply not
available because it's all managed by the NIC card driver. WinPcap sits on top
of it and just receives the packets one by one.</FONT></SPAN></DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri></FONT></SPAN> </DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri>3. Performance-wise at 1Gbps
there is no difference. I definitely prefer pcap_next_ex because I find it
easier to use.</FONT></SPAN></DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri></FONT></SPAN> </DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri>GV</FONT></SPAN></DIV>
<DIV><SPAN
style="WIDOWS: 2; TEXT-TRANSFORM: none; TEXT-INDENT: 0px; BORDER-COLLAPSE: separate; FONT: medium 'Times New Roman'; WHITE-SPACE: normal; ORPHANS: 2; LETTER-SPACING: normal; COLOR: rgb(0,0,0); WORD-SPACING: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px"
class=Apple-style-span><FONT size=3 face=Calibri></FONT> </DIV></SPAN><BR
class=Apple-interchange-newline>
<DIV style="FONT: 10pt Tahoma">
<DIV><BR></DIV>
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A title=hv@itec-audio.com
href="mailto:hv@itec-audio.com">Helmut Vaupotitsch</A> </DIV>
<DIV><B>Sent:</B> Tuesday, September 28, 2010 4:22 AM</DIV>
<DIV><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV><B>Subject:</B> Re: [Winpcap-users] About the packets loss , what is the
bottleneck ?</DIV></DIV></DIV>
<DIV><BR></DIV><TT>Hi Gianluca,<BR><BR>1) According to Section 5.3 and Figures
6,9 in <A class=moz-txt-link-freetext
title="http://www.winpcap.org/docs/WinPcap-SBAC03.pdf CTRL + Click to follow link"
href="http://www.winpcap.org/docs/WinPcap-SBAC03.pdf">http://www.winpcap.org/docs/WinPcap-SBAC03.pdf</A>
(small packets),<BR>timestamp optimization is switched off in the standard
distribution, which costs *a lot* of cpu processing.<BR>Is it possible to turn
on the "rdtsc" instruction on proper cpu´s? (or even turn off
driver-timestamping for special purposes) <BR><BR>2) To have a better
understanding of the bound NIC and the driver in oder to tune the driver
settings (e.g. reduce context switches),<BR>it would be very nice to have some
informations about:<BR># usage of kernel buffer (max, average or anything like
that)<BR># no of frames copied to the kernel buffer during one DPC<BR># no of
frames served by one interrupt<BR><BR>3) R</TT><TT>egarding
performance,</TT><TT> what would you prefer,<BR>pcap_next_ex() or
pcap_loop()?<BR><BR><BR>Best regards<BR>Helmut<BR></TT><BR><BR>Gianluca Varenni
schrieb:
<BLOCKQUOTE cite=mid:7DBB8BF83E8C4EB597DEA456B79D94CD@NELSON3 type="cite">
<META name=GENERATOR content="MSHTML 8.00.7600.16625">
<DIV><FONT face=Calibri>The copies are the following ones:</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Calibri>1. from the NIC driver buffers to the WinPcap kernel
buffer (1st copy)</FONT></DIV>
<DIV><FONT face=Calibri>2. from the kernel buffer to the user buffer (buffer
allocated inside wpcap.dll) (2nd copy)</FONT></DIV>
<DIV> </DIV>
<DIV><FONT face=Calibri>If you copy the packets received from pcap_next_ex (or
any other pcap receive function) to your own application buffer, that would be
a 3rd copy.</FONT></DIV>
<DIV
style="FONT: 10pt Tahoma; font-size-adjust: none; font-stretch: normal"> </DIV>
<DIV
style="FONT: 10pt Tahoma; font-size-adjust: none; font-stretch: normal"><FONT
size=3 face=Calibri>GV</FONT></DIV>
<DIV
style="FONT: 10pt Tahoma; font-size-adjust: none; font-stretch: normal"> </DIV>
<DIV
style="FONT: 10pt Tahoma; font-size-adjust: none; font-stretch: normal"> </DIV>
<DIV
style="FONT: 10pt Tahoma; font-size-adjust: none; font-stretch: normal"> </DIV>
<DIV style="FONT: 10pt Tahoma; font-size-adjust: none; font-stretch: normal">
<DIV><BR></DIV>
<DIV
style="BACKGROUND: rgb(245,245,245) 0% 50%; -moz-background-clip: -moz-initial; -moz-background-origin: -moz-initial; -moz-background-inline-policy: -moz-initial">
<DIV><B>From:</B> <A title=liu.yulou@zte.com.cn
href="mailto:liu.yulou@zte.com.cn"
moz-do-not-send="true">liu.yulou@zte.com.cn</A> </DIV>
<DIV><B>Sent:</B> Sunday, September 26, 2010 10:49 PM</DIV>
<DIV><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org"
moz-do-not-send="true">winpcap-users@winpcap.org</A> </DIV>
<DIV><B>Subject:</B> Re: [Winpcap-users] About the packets loss ,what is the
bottleneck ?</DIV></DIV></DIV>
<DIV><BR></DIV><BR><FONT size=2 face=sans-serif>GV> Not at the moment with
WinPcap. Having said that, I've used this double copy mechanism to bring
several Gbps's to user mode without any packet loss (not with WinPcap, with
custom hardware. However the buffering mechanism was the same).</FONT>
<BR><BR><FONT size=2 face=sans-serif>YL> 'double copy mechanism' ,
Data copy from the user buffer to application(user mode) is the third
copy ? </FONT> <BR><BR><BR><BR><BR><BR><FONT size=2
face=sans-serif>GV>Are you dumping the packets to disk? If so, have you
measured the dump-to-disk bandwidth? </FONT><BR><BR><FONT size=2
face=sans-serif>YL> Yes, Dumping packets to disk is my final goal.
But right now , To avoid the limitation of the disk write speed ,
I just count the packets number in the receive thread. But
on the rate of 614 Mbps, sometimes there are still
packets loss. </FONT><BR><BR><FONT size=2 face=sans-serif>PS.
The route of packets transfer is : FPGA BOARD sends data through ether
net --> PC'S net card --> winpcap kernel buffer -->
winpcap user buffer --> receive thread count . The
FPGA's sending packets rate is about 614 Mbps , the size of each
packet is 1460 bytes, every packet has a sequence number ,
the sending process's starting and stopping can be controlled
. </FONT> <BR><BR><FONT size=2 face=sans-serif>The app that
I make only counts the packet's number when a packet comes without
saving . While the last packet comes , the app will
compare the number (it counts by itself) with the sequence number (of
the last packet). Then I will know if there is packets loss.
</FONT><BR><BR><BR><BR><BR><BR><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="35%"><FONT size=1 face=sans-serif><B>"Gianluca Varenni" <A
class=moz-txt-link-rfc2396E
href="mailto:gianluca.varenni@cacetech.com"><gianluca.varenni@cacetech.com></A></B>
</FONT><BR><FONT size=1 face=sans-serif>发件人: <A
class=moz-txt-link-abbreviated
href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</A></FONT>
<P><FONT size=1 face=sans-serif>2010-09-21 07:41</FONT>
<TABLE border=1>
<TBODY>
<TR vAlign=top>
<TD bgColor=white>
<DIV align=center><FONT size=1 face=sans-serif>请答复 给<BR><A
class=moz-txt-link-abbreviated
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A></FONT></DIV></TD></TR></TBODY></TABLE><BR></P></TD>
<TD width="64%">
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD>
<DIV align=right><FONT size=1 face=sans-serif>收件人</FONT></DIV></TD>
<TD><FONT size=1 face=sans-serif><A class=moz-txt-link-rfc2396E
href="mailto:winpcap-users@winpcap.org"><winpcap-users@winpcap.org></A></FONT>
</TD></TR>
<TR vAlign=top>
<TD>
<DIV align=right><FONT size=1 face=sans-serif>抄送</FONT></DIV></TD>
<TD><BR></TD></TR>
<TR vAlign=top>
<TD>
<DIV align=right><FONT size=1 face=sans-serif>主题</FONT></DIV></TD>
<TD><FONT size=1 face=sans-serif>Re: [Winpcap-users] About the
packets loss , what is the bottleneck
?</FONT></TD></TR></TBODY></TABLE><BR>
<TABLE>
<TBODY>
<TR vAlign=top>
<TD><BR></TD>
<TD><BR></TD></TR></TBODY></TABLE><BR></TD></TR></TBODY></TABLE><BR><BR><BR><FONT
size=3> </FONT> <BR><BR><FONT size=3><B>From:</B> </FONT><A
href="mailto:lyulou@gmail.com" moz-do-not-send="true"><FONT color=blue
size=3><U>yulou liu</U></FONT></A><FONT size=3> </FONT><BR><FONT
size=3><B>Sent:</B> Sunday, September 19, 2010 12:50 AM</FONT> <BR><FONT
size=3><B>To:</B> </FONT><A href="mailto:winpcap-users@winpcap.org"
moz-do-not-send="true"><FONT color=blue
size=3><U>winpcap-users@winpcap.org</U></FONT></A><FONT size=3>
</FONT><BR><FONT size=3><B>Subject:</B> [Winpcap-users] About the packets loss
, what is the bottleneck ?</FONT> <BR><BR><FONT size=2 face=Calibri><BR>There
is still the question about packets loss.<BR>Â </FONT><FONT size=2>Â
</FONT><FONT size=2 face=Calibri><BR>According to the essay 'Â
</FONT><FONT size=2>Profiling and Optimization of Software-Based
Network-Analysis Applications</FONT><FONT size=2 face=Calibri>' ,  Â
every packet is copied twice in the main memory before reaching the
user. In order to reduce the cost of CPU and the bus occupying of the
SDRAM of pc,  is it possible to copy data directly from the kernel
buffer to the final buffer , which I want the date kept in ? Â
 </FONT><BR><FONT size=2> </FONT> <BR><FONT size=2 face=Calibri>GV>
Not at the moment with WinPcap. Having said that, I've used this double copy
mechanism to bring several Gbps's to user mode without any packet loss (not
with WinPcap, with custom hardware. However the buffering mechanism was the
same).</FONT> <BR><FONT size=2 face=Calibri><BR>Â </FONT><FONT size=2>Â
</FONT><FONT size=2 face=Calibri><BR>Here is another idea ---Â </FONT><FONT
size=2> allocate several different user buffers , once </FONT><FONT size=2
face=Calibri>a </FONT><FONT size=2>user buffer is fulled , then let the next
user buffer to save the </FONT><FONT size=2 face=Calibri>new</FONT><FONT
size=2> datas from kernel buffer. Meanwhile copy datas from the first
user buffer to disk (assume that the hard disk write rate is fast
enough).</FONT><FONT size=2 face=Calibri>Â Is this idea work with the
winpcap ?</FONT><FONT size=2>Â </FONT><BR><FONT size=2> </FONT> <BR><FONT
size=3 face=Calibri>GV>Are you dumping the packets to disk? If so, have you
measured the dump-to-disk bandwidth? </FONT><BR><FONT size=2> </FONT>
<BR><FONT size=3 face=Calibri>GV</FONT> <BR><FONT size=2> </FONT>
<BR><FONT size=2> </FONT> <BR><FONT
size=2><TT>_______________________________________________<BR>Winpcap-users
mailing list<BR><A class=moz-txt-link-abbreviated
href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</A><BR><A
class=moz-txt-link-freetext
href="https://www.winpcap.org/mailman/listinfo/winpcap-users">https://www.winpcap.org/mailman/listinfo/winpcap-users</A><BR></TT></FONT><BR><BR><PRE>--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.
This message has been scanned for viruses and Spam by ZTE Anti-Spam system.
</PRE>
<P></P>
<HR>
_______________________________________________<BR>Winpcap-users mailing
list<BR><A class=moz-txt-link-abbreviated
href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</A><BR><A
class=moz-txt-link-freetext
href="https://www.winpcap.org/mailman/listinfo/winpcap-users">https://www.winpcap.org/mailman/listinfo/winpcap-users</A><BR><PRE wrap=""><HR SIZE=4 width="90%">
_______________________________________________
Winpcap-users mailing list
<A class=moz-txt-link-abbreviated href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</A>
<A class=moz-txt-link-freetext href="https://www.winpcap.org/mailman/listinfo/winpcap-users">https://www.winpcap.org/mailman/listinfo/winpcap-users</A></PRE></BLOCKQUOTE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BODY></HTML>