[Winpcap-users] NPF Device Driver

Gianluca Varenni gianluca.varenni at cacetech.com
Fri Apr 10 12:12:18 PDT 2009

  ----- Original Message ----- 
  From: Alessandro Capucci 
  To: winpcap-users at winpcap.org 
  Sent: Friday, April 10, 2009 3:18 AM
  Subject: [Winpcap-users] NPF Device Driver

  Hello to every body,
  I'm new in WinPCap library... I'm study it for an interesting new project... 10GBit deep packet inspection. I'm try to connect directly with WinPCap NPF driver for best performance. All work fine on my 1GBit adapter! Next week I'll hope to star test with 10GBit adapter.

By "connecting directly to the WinPcap Driver" you mean calling the Packet API directly?

  I've some question: 

  0) Do you think that NPF driver with a good hardware can be able to capture 10GBit ethernet packet without sensible packet lost ?

No, I don't think so. Capturing at 10Gbps, expecially in the worst case i.e. 64byte packets, it's an extremely challenging task. Even custom capture cards (which cost thousands of dollars) have a very hard time dealing with such an amount of packets.

  1) Packet.dll functions are callable in multithread applications ? For example can I call PacketReceivePacket or PacketGetStats  in two different concurent thread on the same device ? Are serialized ?

In general the functions are not thread safe when working on the same LPADAPTER structure.

  2) WinPCap NPF drive is able to take advantage of RSS (Receive Side Scaling)  availble in Win2008 server (http://msdn.microsoft.com/en-us/library/ms795609.aspx)?


Have a nice day

  Tnk you very much!


  Winpcap-users mailing list
  Winpcap-users at winpcap.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090410/b83eea11/attachment.htm 

More information about the Winpcap-users mailing list