[Winpcap-users] Better Performance

Charu Agrawal cagrawal at altasens.com
Tue Apr 21 14:20:56 PDT 2009




This is what the code looks like - 


This is all initialization code - 


                if ((adhandle= pcap_open_live(d->name,            //
name of the device

65536,                                  // portion of the packet to

// 65536 grants that the whole packet will be captured on all the MACs.

1,                                                           //
promiscuous mode (nonzero means promiscuous)

1,                                           // read timeout

errbuf                                  // error buffer

)) == NULL)


                                printf("\nUnable to open the adapter. %s
is not supported by WinPcap\n", d->name);


                                return RETCODE_ERR;



                //Set the filter string to the source ip address

                //Only packets from this source address will be

                //This does slow down the capture a bit.



  filter = "src";



                if(pcap_compile(adhandle, &fcode, filter, 1, NetMask) <


compiling filter: wrong syntax.\n");



                                                return RETCODE_ERR;



                if(pcap_setfilter(adhandle, &fcode)<0)


                                                printf("\nError setting
the filter\n");



                                                return RETCODE_ERR;




                //Set the kernel buffer


                if (pcap_setbuff(adhandle,41943040) < 0)


                                printf("\n unable to set buffer");


                                return RETCODE_ERR;




Then I start the pcap_loop on a separate thread -  This function is
called for each packet capture.

I copy the data for all packets in a global array - image_buf 


void packet_handler(u_char *dumpfileHandler, const struct pcap_pkthdr
*header, const u_char *pkt_data)



 //copy the packet data to image_buf and also store the packet length



 image_buf[packetCounter] = (unsigned
char*)(malloc(header->caplen*sizeof(unsigned char)));

 if(image_buf[packetCounter] ==  NULL)


                 printf("\n unable to allocate buffer");






 packetCounter += 1; 




Please let me know if you need more details. I can zip and send the code
file if needed.





From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Tuesday, April 21, 2009 1:51 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Better Performance


Before trying to modify the WinPcap source code, I would try to
understand what the bottlenecks are. What are you doing with the
received packets?


Can you show us the packet processing loop that you have in your code
(even in form of pseudocode)?


Have a nice day


	----- Original Message ----- 

	From: Charu Agrawal <mailto:cagrawal at altasens.com>  

	To: winpcap-users at winpcap.org 

	Sent: Monday, April 20, 2009 10:58 AM

	Subject: [Winpcap-users] Better Performance




	I am trying to figure out how to capture image frames most
efficiently.  Each frame is approximately 20Mbytes.


	I am trying to achieve frame rate of 1-2 frames per second.  The
packets are being received over a Gig eth dedicated link. ( Packets are
sent over that link using only one source).


	I am unable to achieve this frame rate using winpcap. Would it
be helpful to modify the Winpcap source code for better performance ?
Has anyone here have any experience in modifying the winpcap source to
achieve higher frame rate capture ?



	Thanks for your help in advance


	Charu Agrawal


	Winpcap-users mailing list
	Winpcap-users at winpcap.org

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090421/5d2f41ee/attachment-0001.htm 

More information about the Winpcap-users mailing list