[Winpcap-users] Using (Win)Pcap to calculate Throughput

[Guy Harris]

Isara Anantavrasilp wrote:

> Plus, what I really like to know is how to calculate t-put of each 
> "flow" (i.e. each connection).
> As I read the WinPcap manual, I understand that one cannot distinguish 
> the "flow" from just raw packet data.
> (At least WinPcap wont do this for us.)

WinPcap is libpcap for Windows, and determining flows isn't libpcap's 
job - that's the job of the application using WinPcap.

If by "flow" you mean TCP connection, you'd identify the flow to which a 
packet belongs by checking

	1) whether the packet is a TCP packet at all;

	2) if it is, checking the source and destination IPv4/IPv6 addresses 
and TCP port numbers.

 > Therefore I would like to ask if someone has any idea how to calculate
 > flow t-put?

You'd use the sizes of all packets in the flow (or of the payload of all 
packets in the flow, if that's the throughput you want) and the time 
stamps of the first and last packets in the flow to determine the 
throughput of the flow (or of each side of the flow).