[Winpcap-users] Circular buffer
ipopescu at dataq.com
Fri Jun 23 12:35:21 GMT 2006
-----BEGIN PGP SIGNED MESSAGE-----
I have a couple of questions concerning the circular buffer:
1. Is there an API call to determine whether any packets were dropped?
Whether it's because the buffer overflowed or some other reason. Ethereal
seems to be able to do this. I'm testing using "raw" packets, so Ethereal
can't simply look at a counter in the packet and tell whether any were dropped.
2. According to the documentation, the circular buffer should overwrite the
older packets with the latest "wire" packets while at the same time serving
the oldest available packets to the application. Is my understanding correct?
3. I have noticed something peculiar related to kernel memory size and CPU
usage. As I increase the kernel (and user) buffer, the % CPU usage of my
test application goes up. I'm testing this using Task Manager. The test
application stays the same, it uses a command line argument to set the
memory size. It also works on the same set of data. What reason's might
there be for such behavior?
My test is this: "Raw" packets are being sent from a sending station as fast
as possible (benchmark tests). My test application simply checks the
packet's source MAC and a "counter" to manually check for dropped/missed
packets. I've disabled TCP/IP on the network adapter and this is an isolated
network, so there shouldn't be any other traffic to interfere.
WinPCap 4.0 alpha 1 (same problem with 3.1)
WinXP Home SP2
Celeron D - 2.8GHz
512MB PC2700 DDR
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v126.96.36.199 (MingW32)
-----END PGP SIGNATURE-----
More information about the Winpcap-users