[Winpcap-users] Statistical mode help

[Gianluca Varenni]

The reason is probably in the .NET wrapper itself, then. Opening around 100 pcap instances is something that I've never tried, but it might definitely impact the overall system performance.
If you have written the .NET wrapper yourself, I would look into optimizing its code.

Have a nice day
GV




From: pro2c 
Sent: Monday, April 12, 2010 12:40 PM
To: winpcap-users at winpcap.org 
Subject: Re: [Winpcap-users] Statistical mode help


I'm doing this in VB.NET 2005 (.NET 2.0) and with 1,5Mbyte/sec (~3000 packets/sec)  the cpu load is very high.

 


--------------------------------------------------------------------------------

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 9:31 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

Then you should definitely be able to process that amount of packets with a simple user mode application that sorts the packets by TCP port.

 

Have a nice day

GV

 

From: pro2c 

Sent: Monday, April 12, 2010 12:15 PM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

Not much. Traffic of an average computer... about 15Mbit down and 15 up

 


--------------------------------------------------------------------------------

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 9:02 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

How much traffic are we talking about? 

 

Have a nice day

GV

 

From: pro2c 

Sent: Monday, April 12, 2010 11:55 AM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

I already did this (capture all packets and sorted them on their ports) but it was too slow when downloading at full speed. So I turned to statistics as I only need the bytes up/down per port. 

There are about 100 active ports on average, so 100 instances would be neccessary...

 


--------------------------------------------------------------------------------

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 8:50 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

It depends on the number of instances. For sure I wouldn't open 64k instances to monitor all the ports. I would capture all the packets (i.e. no statistics mode) and write my own code to disssect the packets and compute the statistics.

 

GV

 

 

From: pro2c 

Sent: Monday, April 12, 2010 11:42 AM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

Thank you for your reply!

 

One more question: are several instances heavy on the cpu?...can I monitor all the computer's ports without stressing the cpu too much?

 


--------------------------------------------------------------------------------

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 8:37 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

you need to use several instances.

 

Have a nice day

GV

 

From: pro2c 

Sent: Monday, April 12, 2010 11:24 AM

To: winpcap-users at winpcap.org 

Subject: [Winpcap-users] Statistical mode help

 

Hello

 

I've set the stats filter to monitor several tcp ports. I recieve only the data for all these ports together and I wish to be able to get the individual data for each port. Is this possible with 1 instance or do I have to create one instance of winpcap for every port?

 

Thanx

Michael


--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users


--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users


--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users


--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users



--------------------------------------------------------------------------------


_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20100412/f30f017d/attachment-0001.htm