[Winpcap-users] pcap_setbuff occasional failure
Gianluca Varenni
gianluca.varenni at cacetech.com
Fri Jul 31 16:05:00 PDT 2009
Well, the application can be 32bit but the OS can be 64 bit (a 32bit application can peacefully run on an x64 machine).
Have a nice day
GV
----- Original Message -----
From: Sassone, Ed
To: winpcap-users at winpcap.org
Sent: Thursday, July 30, 2009 11:01 AM
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure
Sorry, I was out of town and just saw this.
It should be 32 bit. Our app is not supported on 64 bit currently so all should be 32 bit.
We have seen this failure on a variety of servers but never very often.
Ed Sassone
CONFIDENTIALITY NOTICE: This communication and any files or attachments transmitted with it contain information that is confidential to the sender and/or Autonomy, Inc., privileged or exempt from disclosure under applicable law. It is intended solely for the use of the individual or the entity to which it is addressed. If you are not the intended recipient(s), you are hereby notified that any use, dissemination, or copying of this communication is strictly prohibited; please do not read, copy, use or disclose the content of this communication to others. If you have received this communication in error, please delete it and contact our network administrator at (214) 981-3100. Thank you.
------------------------------------------------------------------------------
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Friday, July 17, 2009 7:20 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure
32 or 64bit windows?
Have a nice day
GV
----- Original Message -----
From: Sassone, Ed
To: winpcap-users at winpcap.org
Sent: Tuesday, July 14, 2009 1:02 PM
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure
Attached is a screen shot of the Task Manager on a system with the pcap_setbuff failure. Sorry it is a little small.
Ed Sassone
CONFIDENTIALITY NOTICE: This communication and any files or attachments transmitted with it contain information that is confidential to the sender and/or Autonomy, Inc., privileged or exempt from disclosure under applicable law. It is intended solely for the use of the individual or the entity to which it is addressed. If you are not the intended recipient(s), you are hereby notified that any use, dissemination, or copying of this communication is strictly prohibited; please do not read, copy, use or disclose the content of this communication to others. If you have received this communication in error, please delete it and contact our network administrator at (214) 981-3100. Thank you.
----------------------------------------------------------------------------
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Thursday, June 04, 2009 11:40 AM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure
Almost for sure it's not a problem with the application. It could be either a bug in the winpcap driver, or a bug in some other driver in the system that causes some memory exhaustion. It's like when a malloc fails in an application. A malloc can fail, usually do to either some memory leak in the application or due to virtual memory exhaustion on the system.
Have a nice day
GV
----- Original Message -----
From: Sassone, Ed
To: winpcap-users at winpcap.org
Sent: Thursday, June 04, 2009 9:29 AM
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure
Thanks. Also can you think of anything in the application that we should do or should not do that might cause this? The error happens very rarely so it is hard to catch.
We are using separate pcap_t handles for each thread.
Ed Sassone
CONFIDENTIALITY NOTICE: This communication and any files or attachments transmitted with it contain information that is confidential to the sender and/or Autonomy, Inc., privileged or exempt from disclosure under applicable law. It is intended solely for the use of the individual or the entity to which it is addressed. If you are not the intended recipient(s), you are hereby notified that any use, dissemination, or copying of this communication is strictly prohibited; please do not read, copy, use or disclose the content of this communication to others. If you have received this communication in error, please delete it and contact our network administrator at (214) 981-3100. Thank you.
--------------------------------------------------------------------------
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Wednesday, June 03, 2009 2:36 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure
The buffer is on an open-instance basis, not on a NIC basis. So it's perfectly safe to have two threads setting different buffer sizes on the same adapter, *provided* that you are using two different pcap_t handles.
Having said that, without a task manager screenshot it's impossible to understand why it failed. The error basically means that a malloc in the kernel driver failed, but it's impossible to know why without more information about the memory load at the time of the failure...
Have a nice day
GV
----- Original Message -----
From: Sassone, Ed
To: winpcap-users at winpcap.org
Sent: Monday, June 01, 2009 7:33 AM
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure
We finally caught the error. We did not get the Task Manager screen shot. Also you are correct in that serializing the initialization did not help.
One thing interesting, we have two threads per NIC card setting different buffer sizes. The first allocation worked and the second did not. The bracketed number is the thread id.
05/29 14:24:54.53 Interface.cpp:93: [00001A54] Set buffer size to 1048576 for interface \Device\NPF_{F4E3EFD7-CAB0-481B-86E3-874358548A34} : Signaling Interface
05/29 14:24:54.53 Interface.cpp:85: [00001174] Could not set buffer size to 5242880 for interface \Device\NPF_{F4E3EFD7-CAB0-481B-86E3-874358548A34}: driver error: not enough memory to allocate the kernel buffer
Ed Sassone
www.autonomy.com
CONFIDENTIALITY NOTICE: This communication and any files or attachments transmitted with it contain information that is confidential to the sender and/or Autonomy, Inc., privileged or exempt from disclosure under applicable law. It is intended solely for the use of the individual or the entity to which it is addressed. If you are not the intended recipient(s), you are hereby notified that any use, dissemination, or copying of this communication is strictly prohibited; please do not read, copy, use or disclose the content of this communication to others. If you have received this communication in error, please delete it and contact our network administrator at (214) 981-3100. Thank you.
------------------------------------------------------------------------
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Sassone, Ed
Sent: Wednesday, October 08, 2008 3:12 PM
To: winpcap-users at winpcap.org
Subject: RE: [Winpcap-users] pcap_setbuff occasional failure
Essentially a critical section around all the adapter initialization calls so it will only be in one set a time, across all threads and adapters. Unfortunately I didn't have it print the pcap_geterr string. I just put that in. It may be awhile until we catch it in the act.
thanks
Ed Sassone
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Wednesday, October 08, 2008 2:05 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure
Serializing pcap_setbuff should not be necessary (serializing against what? multiple calls on the same adapter? on the same pcap_t handle?).
Expecially considering that the only solution is a reboot, I would think that there is some sort of leak either in the WinPcap driver or in some other driver in the system. What's the exact error message returned by pcap_setbuff?
Also, after the problem occurs and before rebooting, open Task Manager, go to the Performance Tab and send me a screenshot of it, if possible.
Have a nice day
GV
----- Original Message -----
From: Sassone, Ed
To: winpcap-users at winpcap.org
Sent: Monday, October 06, 2008 2:15 PM
Subject: [Winpcap-users] pcap_setbuff occasional failure
Hi
Every so often in our application during startup, the pcap_setbuff call will fail. We are unable to re-create the problem but it seems to happen after the application has been stopped and started a number of times. Once the failure occurs it will continue to occur, until a reboot. Our app is multithreaded with two threads starting per interface card, and we can have more than one interface card configured. The buffer size specified can vary but it's usually around 5-10 MB. I have recently put in some changes to serialize the command in case there is a timing issue, as I'm not sure if the call is thread safe. I remember there was thread issue with the filter command. This is on Windows 2003. Any other ideas?
thanks
Ed Sassone
----------------------------------------------------------------------
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
------------------------------------------------------------------------
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
--------------------------------------------------------------------------
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
----------------------------------------------------------------------------
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
------------------------------------------------------------------------------
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090731/b1ee0970/attachment-0001.htm
More information about the Winpcap-users
mailing list