[Winpcap-users] TurboCap device
gianluca.varenni at cacetech.com
Tue Jul 8 16:05:35 GMT 2008
----- Original Message -----
From: "Renato Araújo Ferreira" <marina.peixe at terra.com.br>
To: <winpcap-users at winpcap.org>
Sent: Monday, July 07, 2008 3:40 PM
Subject: [Winpcap-users] TurboCap device
> Hello, all...
> I'd like to know how turbocap device works. If it's looks like as a very
> large OS level buffer to avoid the packets of being droped in high
> throughputs, and if I need to change one implementation that already work
> with winpcap with common network devices.
I'm not sure if I understood your questions completely. However, this is a
very brief explanation of how TurboCap works and how it differs from the
standard WinPcap driver.
In the normal WinPcap case, the driver stack used to receive packets is
- a NIC miniport (written by the NIC manufactor) that deals with the
hardware and exports a standard windows interface to deliver packets to the
- zero or more IM drivers (written by 3rd parties) that can
analyze/monitor/block packets. Personal firewalls and QoS packet scheduler
are IM drivers.
- the WinPcap protocol driver (npf.sys) which receives the packets from the
underlying layer(s) (i.e. NIC miniport or the IM drivers) and delivers them
to user level.
This stack architecture uses a framework provided by MS called NDIS (it's
not 100% true as NDIS was designed in conjuction with other companies, if i
remember well before even Windows, there was some NDIS stuff for DOS or
similar). The NDIS framework was not designed with packet capture in mind,
although it definitely allows you to create network sniffers.
TurboCap instead is a monolitic driver that talks directly with a specific
NIC card (based on an Intel chipset), buffers the packets in the driver and
delivers them to user mode applications.
If you use a TurboCap board and have a WinPcap based application, the
TurboCap board is accessible directly through the WinPcap interface
(although some features might not be available) or rewrite the capture part
of your application using the TurboCap native API.
Let me know if this answers your question.
Have a nice day
> Renato A. Ferreira
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
More information about the Winpcap-users