[Winpcap-users] pcap_loop callback timing problem..

[Gianluca Varenni]

  ----- Original Message ----- 
  From: James Hunter 
  To: winpcap-users at winpcap.org 
  Sent: Tuesday, May 19, 2009 8:33 AM
  Subject: [Winpcap-users] pcap_loop callback timing problem..


  Hi,

   

  I`m creating an application that can sniff packets from a network interface real-time, whilst repeating only certain packets to a different network interface.

   

  I have found that the callback is being called multiple times in a burst style, rather than as packets arrive. If the network sends packets every 100ms, I will receive 10 callbacks immediately after each other - with each burst of 10 callbacks spaced about a second apart..

   

This is the default behavior of WinPcap. WinPcap is a capture engine, so it favors efficiency and performance over low latency in receiving packets. Basically packets are stored in the kernel and brought to user mode in batches, checking these 2 conditions

1. a timeout occurs (the timeout that you set in pcap_openlive)

2. at least mintocopy bytes are present in the kernel buffer (by default it's 16k if you use pcap_openlive)

(whatever happens first).



You can lower this latency by playing with mintocopy (use pcap_setmintocopy to change it) or with the timeout, remembering that the lower those values are, the lower the latency in receiving packets is, *obviously* with a performance hit.



Hope it helps

GV



  This is causing problems at the far end which expects a constant flow of packets, is there anything I can do get the callback to trigger as and when packets arrive?

   

  Regards,

   

  James

   



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090519/8569bbdf/attachment.htm