[Winpcap-users] Statistical mode help

[Boaz Brickner]

Have you tried Pcap.Net?
http://pcapdotnet.codeplex.com

Boaz.

On Mon, Apr 12, 2010 at 23:06, pro2c <pro2c at litrca.com> wrote:

>  No, I didn't write the wrapper. But this is the only one for .NET 2.0
> (sharppcap)  L
>
>
>  ------------------------------
>
> *From:* winpcap-users-bounces at winpcap.org [mailto:
> winpcap-users-bounces at winpcap.org] *On Behalf Of *Gianluca Varenni
>
> *Sent:* Monday, April 12, 2010 9:50 PM
> *To:* winpcap-users at winpcap.org
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> The reason is probably in the .NET wrapper itself, then. Opening around 100
> pcap instances is something that I've never tried, but it might definitely
> impact the overall system performance.
>
> If you have written the .NET wrapper yourself, I would look into optimizing
> its code.
>
>
>
> Have a nice day
>
> GV
>
>
>
>
>
>
>
> *From:* pro2c <pro2c at litrca.com>
>
> *Sent:* Monday, April 12, 2010 12:40 PM
>
> *To:* winpcap-users at winpcap.org
>
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> I'm doing this in VB.NET 2005 (.NET 2.0) and with 1,5Mbyte/sec (~3000
> packets/sec)  the cpu load is very high.
>
>
>  ------------------------------
>
> *From:* winpcap-users-bounces at winpcap.org [mailto:
> winpcap-users-bounces at winpcap.org] *On Behalf Of *Gianluca Varenni
> *Sent:* Monday, April 12, 2010 9:31 PM
> *To:* winpcap-users at winpcap.org
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> Then you should definitely be able to process that amount of packets with a
> simple user mode application that sorts the packets by TCP port.
>
>
>
> Have a nice day
>
> GV
>
>
>
> *From:* pro2c <pro2c at litrca.com>
>
> *Sent:* Monday, April 12, 2010 12:15 PM
>
> *To:* winpcap-users at winpcap.org
>
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> Not much. Traffic of an average computer... about 15Mbit down and 15 up
>
>
>  ------------------------------
>
> *From:* winpcap-users-bounces at winpcap.org [mailto:
> winpcap-users-bounces at winpcap.org] *On Behalf Of *Gianluca Varenni
> *Sent:* Monday, April 12, 2010 9:02 PM
> *To:* winpcap-users at winpcap.org
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> How much traffic are we talking about?
>
>
>
> Have a nice day
>
> GV
>
>
>
> *From:* pro2c <pro2c at litrca.com>
>
> *Sent:* Monday, April 12, 2010 11:55 AM
>
> *To:* winpcap-users at winpcap.org
>
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> I already did this (capture all packets and sorted them on their ports) but
> it was too slow when downloading at full speed. So I turned to statistics as
> I only need the bytes up/down per port.
>
> There are about 100 active ports on average, so 100 instances would be
> neccessary...
>
>
>  ------------------------------
>
> *From:* winpcap-users-bounces at winpcap.org [mailto:
> winpcap-users-bounces at winpcap.org] *On Behalf Of *Gianluca Varenni
> *Sent:* Monday, April 12, 2010 8:50 PM
> *To:* winpcap-users at winpcap.org
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> It depends on the number of instances. For sure I wouldn't open 64k
> instances to monitor all the ports. I would capture all the packets (i.e. no
> statistics mode) and write my own code to disssect the packets and compute
> the statistics.
>
>
>
> GV
>
>
>
>
>
> *From:* pro2c <pro2c at litrca.com>
>
> *Sent:* Monday, April 12, 2010 11:42 AM
>
> *To:* winpcap-users at winpcap.org
>
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> Thank you for your reply!
>
>
>
> One more question: are several instances heavy on the cpu?...can I monitor
> all the computer's ports without stressing the cpu too much?
>
>
>  ------------------------------
>
> *From:* winpcap-users-bounces at winpcap.org [mailto:
> winpcap-users-bounces at winpcap.org] *On Behalf Of *Gianluca Varenni
> *Sent:* Monday, April 12, 2010 8:37 PM
> *To:* winpcap-users at winpcap.org
> *Subject:* Re: [Winpcap-users] Statistical mode help
>
>
>
> you need to use several instances.
>
>
>
> Have a nice day
>
> GV
>
>
>
> *From:* pro2c <pro2c at litrca.com>
>
> *Sent:* Monday, April 12, 2010 11:24 AM
>
> *To:* winpcap-users at winpcap.org
>
> *Subject:* [Winpcap-users] Statistical mode help
>
>
>
> Hello
>
>
>
> I've set the stats filter to monitor several tcp ports. I recieve only the
> data for all these ports together and I wish to be able to get the
> individual data for each port. Is this possible with 1 instance or do I have
> to create one instance of winpcap for every port?
>
>
>
> Thanx
>
> Michael
>  ------------------------------
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>  ------------------------------
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>  ------------------------------
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>  ------------------------------
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>  ------------------------------
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20100412/229b743e/attachment-0001.htm