Thanks Mark Pizzolato.<br><br>I actually got output, through a different approach.<br>I used pcap_open_live( ) and pcap_next_ex( ).<br><br>But I have question, kindly help me figure out this.<br><br>when i use the pcap_open_live( ) and pcap_next_ex( ), i see some packets captured.<br>
But what are these packets?<br>how are they generated?<br>Am i generating them?<br><br><br>Your suggestions will be valuable to me.<br><br><br><div class="gmail_quote">On Wed, Jul 13, 2011 at 6:18 PM, <span dir="ltr"><<a href="mailto:winpcap-users-request@winpcap.org">winpcap-users-request@winpcap.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Send Winpcap-users mailing list submissions to<br>
<a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a><br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
or, via email, send a message with subject or body 'help' to<br>
<a href="mailto:winpcap-users-request@winpcap.org">winpcap-users-request@winpcap.org</a><br>
<br>
You can reach the person managing the list at<br>
<a href="mailto:winpcap-users-owner@winpcap.org">winpcap-users-owner@winpcap.org</a><br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Winpcap-users digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. Re: how to find active ports (Mark Pizzolato - WinPCap-Users)<br>
2. Performance issues and c# wrappers (Emre Eri?gen)<br>
3. Re: Performance issues and c# wrappers (Black, Michael (IS))<br>
4. Re: Performance issues and c# wrappers (Emre Eri?gen)<br>
5. PacketRequest on a Wan-adapter (Gisle Vanem)<br>
6. Re: EXT :Re: Performance issues and c# wrappers<br>
(Black, Michael (IS))<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Tue, 12 Jul 2011 20:00:52 -0700<br>
From: Mark Pizzolato - WinPCap-Users<br>
<<a href="mailto:winpcap-users-20040408@subscriptions.pizzolato.net">winpcap-users-20040408@subscriptions.pizzolato.net</a>><br>
To: "<a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>" <<a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>><br>
Subject: Re: [Winpcap-users] how to find active ports<br>
Message-ID:<br>
<<a href="mailto:0CC6789C1C831B4C8CCFF49D45D7010F290403ED6B@REDROOF2.alohasunset.com">0CC6789C1C831B4C8CCFF49D45D7010F290403ED6B@REDROOF2.alohasunset.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
Hi there Rajath,<br>
<br>
Winpcap doesn't contain a single API which provides the specific answer you are looking for.<br>
<br>
However, you could determine the answer you are looking for with a little coding on your part. The following steps will achieve the desired result:<br>
1) Use pcap_findalldevs to enumerate the set of 'ports' as you say.<br>
2) For each enumerated port, use pcap_openlive to open a promiscuous mode pcap handle to the port.<br>
3) For each enumerated port, Craft a packet which says "Sending on Port #N" and use any source MAC address (without Bi1#1 set (i.e. the Broadcast/multicast bit sent), use a destination MAC address of FF:FF:FF:FF:FF:FF. Send the packet on the pcap handle using pcap_sendpacket. Read arriving packets on each of the pcap handles looking for the crafted packet. Each time you find a packet you sent, you've found a 'loopbacked' port (the loopbacks here could also indicate multiple ports connected to the same switch, which is equivalent to a set of ports connected with a crossover cable).<br>
<br>
Good Luck.<br>
<br>
- Mark Pizzolato<br>
<br>
On Monday, July 04, 2011 5:44 AM, rajath kumara wrote:<br>
<br>
> Thanks for the reply.<br>
><br>
> However guess, its better to restate my problem, so that i can make you<br>
> people clear about my query.<br>
><br>
> I am using some ?3 NICS ( network interface cards), which together get me 10<br>
> ports.<br>
> 2 NICs are are from D-Link NIC cards which have 4 ports each in them, and<br>
> another is NETGEAR NIC, which has 2 ports in it.<br>
><br>
> with the help of pcap_findalldevs() , i can obtain the list of all ports ,<br>
> along with details of NIC cards, their MAC_ addresses and others.<br>
><br>
> But my question is , pcap_findalldevs( ), gives me list of all 10 ports i am<br>
> using,<br>
><br>
> assume i use a cross-cable and connect any 2 ports to form a loopback<br>
> condition,then ?is their any function in wpcap, which tells me<br>
> which 2 ports are in loopback state among the 10 ports i am using.<br>
><br>
> or any other function is their apart from wpcap, which helps me to do this.<br>
><br>
><br>
> please help me to figure out this problem.<br>
><br>
<br>
<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Wed, 13 Jul 2011 14:09:29 +0300<br>
From: Emre Eri?gen <<a href="mailto:emreerisgen@gmail.com">emreerisgen@gmail.com</a>><br>
To: <a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a><br>
Subject: [Winpcap-users] Performance issues and c# wrappers<br>
Message-ID:<br>
<CAF8arNifT2kQugbmBznyhTAf_00Z9+Z=xKjw35Dang3N1-E=<a href="mailto:vw@mail.gmail.com">vw@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
I want to write a program which will listen the network device and capture<br>
packets and saves them as dump files. The problem is packet loss must be<br>
really really small in high transfer rates. What is the maximum transfer<br>
rate for winpcap library? Can i capture 100mbit/sec without packet loss? I<br>
have to write this program with C# so by wrapping winpcap for using in C#<br>
will decrease the program performance? Do you know the performance of<br>
wrappers like <a href="http://pcp.net" target="_blank">pcp.net</a> and sharppcap? By performance i mean maximum transfer<br>
rate without packet loss. Any help will be appreciated. Thank you for<br>
reading.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/02a51435/attachment-0001.html" target="_blank">http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/02a51435/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 3<br>
Date: Wed, 13 Jul 2011 11:56:57 +0000<br>
From: "Black, Michael (IS)" <<a href="mailto:Michael.Black2@ngc.com">Michael.Black2@ngc.com</a>><br>
To: "<a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>" <<a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>><br>
Subject: Re: [Winpcap-users] Performance issues and c# wrappers<br>
Message-ID: <55D44176-CAE1-47F1-A797-14177DD064E0@mimectl><br>
Content-Type: text/plain; charset="iso-8859-2"<br>
<br>
I don't know what kind of network you're on.<br>
<br>
But 100mbit/sec is nothing anymore.<br>
<br>
<br>
<br>
Today's switches have gigabit ports to interconnect them because the ports can all do 100Mbit EACH for example. One 100Mbit port can't watch fast enough to capture the traffic that can occur on the switch.<br>
<br>
<br>
<br>
So you really have to either bond ports together or sit on the gigabit port to capture traffic.<br>
<br>
<br>
<br>
Nonetheless -- you'll want to multitrread your application for writing to disk.<br>
<br>
<br>
<br>
You can probably get by without that for 100Mbit/sec (that's only 12MB/sec to disk which should be a doable sustained rate on a single thread). But if your disk I/O pauses too long you may drop things.<br>
<br>
<br>
<br>
You can tell that by running a ping while blasting data at it and the looking to see if you capture all the pings.<br>
<br>
Or better, by running a small test program which sends 10 packets a second or such and ensure you see all the packets while blasting data on the network.<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
Michael D. Black<br>
<br>
Senior Scientist<br>
<br>
NG Information Systems<br>
<br>
Advanced Analytics Directorate<br>
<br>
<br>
<br>
________________________________<br>
From: <a href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</a> [<a href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</a>] on behalf of Emre Eri?gen [<a href="mailto:emreerisgen@gmail.com">emreerisgen@gmail.com</a>]<br>
Sent: Wednesday, July 13, 2011 6:09 AM<br>
To: <a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a><br>
Subject: EXT :[Winpcap-users] Performance issues and c# wrappers<br>
<br>
I want to write a program which will listen the network device and capture packets and saves them as dump files. The problem is packet loss must be really really small in high transfer rates. What is the maximum transfer rate for winpcap library? Can i capture 100mbit/sec without packet loss? I have to write this program with C# so by wrapping winpcap for using in C# will decrease the program performance? Do you know the performance of wrappers like <a href="http://pcp.net" target="_blank">pcp.net</a><<a href="http://pcp.net/" target="_blank">http://pcp.net/</a>> and sharppcap? By performance i mean maximum transfer rate without packet loss. Any help will be appreciated. Thank you for reading.<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/7c8d7dd1/attachment-0001.html" target="_blank">http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/7c8d7dd1/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 4<br>
Date: Wed, 13 Jul 2011 15:29:00 +0300<br>
From: Emre Eri?gen <<a href="mailto:emreerisgen@gmail.com">emreerisgen@gmail.com</a>><br>
To: <a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a><br>
Subject: Re: [Winpcap-users] Performance issues and c# wrappers<br>
Message-ID:<br>
<<a href="mailto:CAF8arNjT6z7r%2B4qBuJuH4Bw0yWvhxRoFRktWtBGqnhx%2Bxt1YkA@mail.gmail.com">CAF8arNjT6z7r+4qBuJuH4Bw0yWvhxRoFRktWtBGqnhx+xt1YkA@mail.gmail.com</a>><br>
Content-Type: text/plain; charset="iso-8859-1"<br>
<br>
Thank you so much for your answer. I think I should explain about my problem<br>
a little bit more. I want to listen a network which has an internet<br>
connection around 50mbit/sec. My problem is i have to use C# for this<br>
program and so i need to wrap winpcap to use it. There are some open source<br>
C# wrappers like sharppcap and <a href="http://pcap.net" target="_blank">pcap.net</a>. I wonder if i use these wrappers<br>
can i listen and capture 50mbit/sec without packet loss. Is using a wrapper<br>
will reduce the performance of winpcap? I just need to listen, capture and<br>
save them to a dump file so my wrapper will not be much a big project. Do<br>
writing my own little wrapper help me to reduce performance reduction?<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/2a250bcc/attachment-0001.html" target="_blank">http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/2a250bcc/attachment-0001.html</a>><br>
<br>
------------------------------<br>
<br>
Message: 5<br>
Date: Wed, 13 Jul 2011 14:31:01 +0200<br>
From: Gisle Vanem <<a href="mailto:gvanem@broadpark.no">gvanem@broadpark.no</a>><br>
To: WinDump <<a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>><br>
Subject: [Winpcap-users] PacketRequest on a Wan-adapter<br>
Message-ID: <<a href="mailto:4DD97382C5594DD69428D24FF34F2CBB@broadpark.no">4DD97382C5594DD69428D24FF34F2CBB@broadpark.no</a>><br>
Content-Type: text/plain; CHARSET=US-ASCII; format=flowed;<br>
reply-type=original<br>
<br>
Hi list.<br>
<br>
The PacketRequest() function is obviously not suited for getting<br>
the low-level stuff (such as MTU and MAC-address) from a WAN (PPP/SLIP)<br>
interface. I'm getting the error "PacketRequest not supported on non-NPF/NPFIM<br>
adapters" in the winpcap_debug.txt file.<br>
<br>
How can I get such things with another function or API? Device in question<br>
is named "\Device\NPF_GenericDialupAdapter". I can listen on the adapter<br>
just fine. It is the un-encrypted end of my VPN connection.<br>
<br>
--gv<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Message: 6<br>
Date: Wed, 13 Jul 2011 12:48:35 +0000<br>
From: "Black, Michael (IS)" <<a href="mailto:Michael.Black2@ngc.com">Michael.Black2@ngc.com</a>><br>
To: "<a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>" <<a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>><br>
Subject: Re: [Winpcap-users] EXT :Re: Performance issues and c#<br>
wrappers<br>
Message-ID: <19623639-CC0A-481E-A8BD-A642B245A1B5@mimectl><br>
Content-Type: text/plain; charset="iso-8859-2"<br>
<br>
50Mb/sec is quite doable.<br>
<br>
<br>
<br>
You won't know the answer "for sure" until you test it.<br>
<br>
<br>
<br>
I doubt the wrapper will hurt much. Any additional layer slows things down but not necessarily by very much.<br>
<br>
<br>
<br>
Write your app and watch the CPU usage. If it gets anywhere close to 100% for any sustained period of time than then you'll need to optimize. But my guess is you'll be much less than that.<br>
<br>
<br>
<br>
If all your doing is listening and saving than 2 threads is probably all you could possibly use, one to capture and push on a queue and another to pop the packet off the queue and write it to disk.<br>
<br>
<br>
<br>
My guess is you can keep up with 50Mb/sec internet and the 6.25MB/sec to disk without any problem.<br>
<br>
Hopefully you do have a decent disk system to write to as you're talking probably 11GB/hour based on 50% utilization of the bandwidth. So you can fill up a disk pretty fast.<br>
<br>
<br>
<br>
<br>
<br>
Michael D. Black<br>
<br>
Senior Scientist<br>
<br>
NG Information Systems<br>
<br>
Advanced Analytics Directorate<br>
<br>
<br>
<br>
________________________________<br>
From: <a href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</a> [<a href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</a>] on behalf of Emre Eri?gen [<a href="mailto:emreerisgen@gmail.com">emreerisgen@gmail.com</a>]<br>
Sent: Wednesday, July 13, 2011 7:29 AM<br>
To: <a href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</a><br>
Subject: EXT :Re: [Winpcap-users] Performance issues and c# wrappers<br>
<br>
Thank you so much for your answer. I think I should explain about my problem a little bit more. I want to listen a network which has an internet connection around 50mbit/sec. My problem is i have to use C# for this program and so i need to wrap winpcap to use it. There are some open source C# wrappers like sharppcap and <a href="http://pcap.net" target="_blank">pcap.net</a><<a href="http://pcap.net/" target="_blank">http://pcap.net/</a>>. I wonder if i use these wrappers can i listen and capture 50mbit/sec without packet loss. Is using a wrapper will reduce the performance of winpcap? I just need to listen, capture and save them to a dump file so my wrapper will not be much a big project. Do writing my own little wrapper help me to reduce performance reduction?<br>
-------------- next part --------------<br>
An HTML attachment was scrubbed...<br>
URL: <<a href="http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/8a1e4796/attachment.html" target="_blank">http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/8a1e4796/attachment.html</a>><br>
<br>
------------------------------<br>
<br>
_______________________________________________<br>
Winpcap-users mailing list<br>
<a href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a><br>
<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br>
<br>
<br>
End of Winpcap-users Digest, Vol 76, Issue 7<br>
********************************************<br>
</blockquote></div><br>