[Winpcap-users] MODE_STAT

[Fitt, Jonathan]

No, it's not hyper threaded, just a Pentium M 1.7GHz
 
Thanks,
Jonathan

________________________________

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Friday, December 07, 2007 7:10 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] MODE_STAT


Are you running this code on an SMP (multiprocessor, multicore or
hyperthreaded) machine?
 
Have a nice day
GV

	----- Original Message ----- 
	From: Fitt, Jonathan <mailto:Jonathan.Fitt at anritsu.com>  
	To: winpcap-users at winpcap.org 
	Sent: Friday, December 07, 2007 3:09 PM
	Subject: RE: [Winpcap-users] MODE_STAT

	Thanks GV.
	 
	Is the callback function called immediately when a stat report
is compiled?
	 
	The reason I ask is: if I have a 100ms sample time and use a
system timer to log when the callback is called it is pretty reliably
every 100ms, but when I log the report header timestamps they are mainly
every 100ms, but occasionally 800ms or -600ms!
	 
	As an example:
	Report header time/      packets in report /     difference from
last header time
	1197065236.922320         64      103.069782
	1197065237.228180         62      305.860043
	1197065237.132800         67      -95.379829
	1197065237.242820         68      110.019922
	1197065237.343190         63      100.369930
	1197065237.450960         67      107.769966
	1197065237.553170         64      102.210045
	1197065237.653380         62      100.209951
	1197065237.753430         62      100.049973
	1197065237.853580         62      100.150108
	1197065237.953730         62      100.150108
	1197065238.538680         61      584.949970
	1197065238.154090         62      -384.590149
	1197065238.254160         61      100.070000
	1197065238.364150         63      109.990120
	1197065238.464530         64      100.379944
	1197065238.564680         62      100.150108
	1197065238.664820         62      100.139856
	1197065238.764970         62      100.150108
	 
	I am stressing it by flooding the captured address with lots of
large udp packets, but can you think why I would occasionally be seeing
that the report was 3* or 5* a capture period from the last one, or
maybe 3* a capture period before it?
	Even if I sort the reports by header time, it's still not
reliably every 100ms.
	 
	Thanks,
	 
	Jonathan

________________________________

	From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
	Sent: Friday, December 07, 2007 3:56 PM
	To: winpcap-users at winpcap.org
	Subject: Re: [Winpcap-users] MODE_STAT
	
	
	The timestamp is generated when the stat reports are computed in
the driver.
	 
	While in the callback function, the packets are buffered by the
kernel buffer managed by the WinPcap kernel driver, npf.sys. In
particular, if you are in statistical mode, packets are not actually
buffered at all, the driver receives the packets from the OS, updates
the statistics and releases the packet. This update is completely
independent from the callback function.
	 
	Have a nice day
	GV
	 

		----- Original Message ----- 
		From: Fitt, Jonathan <mailto:Jonathan.Fitt at anritsu.com>

		To: winpcap-users at winpcap.org 
		Sent: Thursday, December 06, 2007 2:11 PM
		Subject: [Winpcap-users] MODE_STAT

		My question is about using pcap in statistical mode.
		 
		The timeval attached to the stat report header, when
exactly is that time?
		Is it the time the capture started, or timed out?
		 
		Also, while in the callback function are all packets
received/sent buffered up so that they'll appear in the next report?
		I don't want to miss any while in the callback function.
		 
		Thanks,
		 
		Jonathan

		
________________________________


		

		_______________________________________________
		Winpcap-users mailing list
		Winpcap-users at winpcap.org
		https://www.winpcap.org/mailman/listinfo/winpcap-users
		

	
________________________________


	

	_______________________________________________
	Winpcap-users mailing list
	Winpcap-users at winpcap.org
	https://www.winpcap.org/mailman/listinfo/winpcap-users
	

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20071210/05516654/attachment.htm