[Winpcap-users] Captured packets buffered and not returned totheapplication immediately

[Gianluca Varenni]

  ----- Original Message ----- 
  From: Oliver Zheng 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, December 10, 2008 4:38 PM
  Subject: Re: [Winpcap-users] Captured packets buffered and not returned totheapplication immediately


  Ah that makes sense. Thanks for the clarification.



    If you set the timeout to 0 (infinite timeout), mintocopy is the factor affecting the reception.

  Where is mintocopy defined? 

The default value when you open an adapter with pcap_open/pcap_open_live is 16000 bytes. You can change it with pcap_setmintocopy(http://www.winpcap.org/docs/docs_41b4/html/group__wpcapfunc.html#gb14ceacbf1c2f63026416dd73f80dc0d).


    pcap_next_ex (or any other WinPcap receive function) will return
    - after the timeout (unless you used 0)
    - when at least mintocopy bytes are stored in the kernel buffer

    (whatever happens first).

    It's not a bug in WinPcap, this is by design. Why are you using an infinite timeout?

  Is that the intended usage, to use a timeout? I really do not need to have a timeout; I want a packet when it arrives. But if the only way to circumvent mintocopy is to have a timeout, then I don't mind it. Then I suppose pcap_next_ex() would be more useful than pcap_next() since its return code indicates a timeout...

I definitely suggest you to use pcap_next_ex().

  Is there a way to change the size of mintocopy? I am guessing no, since that's kernel level code.

pcap_setmintocopy().

Have a nice day
GV


  Cheers,
  Oliver



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20081212/ddea5562/attachment.htm