[Winpcap-users] DMA and Kernel Buffer Issues

[Gianluca Varenni]

----- Original Message ----- 
From: "Zafer SAVAS" <zsavas at aselsan.com.tr>
To: <winpcap-users at winpcap.org>
Sent: Thursday, May 08, 2008 9:03 AM
Subject: [Winpcap-users] DMA and Kernel Buffer Issues


>
> Hello winpcap users,
>
> I have 2 questions about packet capturing. Would someone please share 
> his/her knowledge about them?
>
> - Does all of the ethernet adapters support DMA transfer? I mean; after a 
> packet is received, is it transfered to the user side (Kernel buffer of 
> the winpcap library) with a DMA transfer or not?

All the PCI/PCIe/CardBus network cards use DMA to transfer data from the 
board to the host. It's the only way to get the desired performance. Memory 
mapped I/O is too slow. Also, WinPcap does not deal with DMA at all. It 
receives the packets from the network miniport driver that controls the 
network card. The miniport driver is responsible for managing the DMA 
transfers with the hardware.

>
> - There are two functions, pcap_setbuff() and pcap_setmintocopy(), in 
> winpcap. Although they are explained in winpcap documentation, would 
> someone please explain their functionality in detail? Has someone ever 
> observed their effect? Also I appreciate if someone posts a code segment 
> about the usage of them?

setbuff sets the size of the kernel ring buffer used to receive packets. 
What happens is that the network miniport driver controlling your network 
card delivers a packet to  the WinPcap driver npf.sys. The driver stores 
this packet in the ring buffer. User applications periodically perform read 
operations to drain packets out of the ring buffer up to user mode. A single 
read from user mode retrieve multiple packets, to minimize the number of 
system calls used to move packets from the ring buffer (in kernel mode) to 
user mode. A signalling mechanism based on events, timeouts and mintocopy is 
used to control the transfer.

pcap_mintocopy controls this signalling mechanism. Basically, the user mode 
code doesn't get notified immediately when a packet is available in the 
kernel ring buffer. The user mode code gets signalled of *some* available 
packets (thru an event) when at least "mintocopy" bytes are available in the 
kernel buffer. Again, this mechanism is used to avoid reading one single 
packet at a time from kernel mode to user mode.

I hope this explains the two parameters.

Have a nice day
GV

>
> Kind regards
> zafer
> ######################################################################
> Dikkat:
>
> Bu elektronik posta mesaji kisisel ve ozeldir. Eger size
> gonderilmediyse lutfen gondericiyi bilgilendirip mesaji siliniz.
> Firmamiza gelen ve giden mesajlar virus taramasindan gecirilmekte,
> guvenlik nedeni ile kontrol edilerek saklanmaktadir. Mesajdaki
> gorusler ve bakis acisi gondericiye ait olup Aselsan A.S. resmi
> gorusu olmak zorunda degildir.
>
> ######################################################################
> Attention:
>
> This e-mail message is privileged and confidential. If you are
> not the intended recipient please delete the message and notify
> the sender. E-mails to and from the company are monitored for
> operational reasons and in accordance with lawful business practices.
> Any views or opinions presented are solely those of the author and
> do not necessarily represent the views of the company.
>
> ######################################################################
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users