[Winpcap-users] MODE_STAT

[Gianluca Varenni]

Are you running this code on an SMP (multiprocessor, multicore or hyperthreaded) machine?

Have a nice day
GV
  ----- Original Message ----- 
  From: Fitt, Jonathan 
  To: winpcap-users at winpcap.org 
  Sent: Friday, December 07, 2007 3:09 PM
  Subject: RE: [Winpcap-users] MODE_STAT


  Thanks GV.

  Is the callback function called immediately when a stat report is compiled?

  The reason I ask is: if I have a 100ms sample time and use a system timer to log when the callback is called it is pretty reliably every 100ms, but when I log the report header timestamps they are mainly every 100ms, but occasionally 800ms or -600ms!

  As an example:
  Report header time/      packets in report /     difference from last header time
  1197065236.922320         64      103.069782
  1197065237.228180         62      305.860043
  1197065237.132800         67      -95.379829
  1197065237.242820         68      110.019922
  1197065237.343190         63      100.369930
  1197065237.450960         67      107.769966
  1197065237.553170         64      102.210045
  1197065237.653380         62      100.209951
  1197065237.753430         62      100.049973
  1197065237.853580         62      100.150108
  1197065237.953730         62      100.150108
  1197065238.538680         61      584.949970
  1197065238.154090         62      -384.590149
  1197065238.254160         61      100.070000
  1197065238.364150         63      109.990120
  1197065238.464530         64      100.379944
  1197065238.564680         62      100.150108
  1197065238.664820         62      100.139856
  1197065238.764970         62      100.150108

  I am stressing it by flooding the captured address with lots of large udp packets, but can you think why I would occasionally be seeing that the report was 3* or 5* a capture period from the last one, or maybe 3* a capture period before it?
  Even if I sort the reports by header time, it's still not reliably every 100ms.

  Thanks,

  Jonathan



------------------------------------------------------------------------------
  From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
  Sent: Friday, December 07, 2007 3:56 PM
  To: winpcap-users at winpcap.org
  Subject: Re: [Winpcap-users] MODE_STAT


  The timestamp is generated when the stat reports are computed in the driver.

  While in the callback function, the packets are buffered by the kernel buffer managed by the WinPcap kernel driver, npf.sys. In particular, if you are in statistical mode, packets are not actually buffered at all, the driver receives the packets from the OS, updates the statistics and releases the packet. This update is completely independent from the callback function.

  Have a nice day
  GV

    ----- Original Message ----- 
    From: Fitt, Jonathan 
    To: winpcap-users at winpcap.org 
    Sent: Thursday, December 06, 2007 2:11 PM
    Subject: [Winpcap-users] MODE_STAT


    My question is about using pcap in statistical mode.

    The timeval attached to the stat report header, when exactly is that time?
    Is it the time the capture started, or timed out?

    Also, while in the callback function are all packets received/sent buffered up so that they'll appear in the next report?
    I don't want to miss any while in the callback function.

    Thanks,

    Jonathan


----------------------------------------------------------------------------


    _______________________________________________
    Winpcap-users mailing list
    Winpcap-users at winpcap.org
    https://www.winpcap.org/mailman/listinfo/winpcap-users



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20071208/ef90edac/attachment.htm