[Winpcap-users] Multiple instances

[David Chang]

What statistics are you capturing?  For example...

Src IP Addr   Protocol   Port  Upload pkts Download pkts
------------ ---------- ------ ----------- -------------
192.168.1.1     TCP         80        2341       2419866
192.168.1.1     UDP       5000         987          1026
192.168.1.2     TCP         80        1298       1672340

DC

pro2c wrote:
> I'm trying to make an active list of computer's ports with download and
> upload statistics. So i need 2 instances for 1 port (download & upload)
>
>
> -----Original Message-----
> From: winpcap-users-bounces at winpcap.org
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of David Chang
> Sent: Thursday, May 13, 2010 7:49 PM
> To: winpcap-users at winpcap.org
> Subject: Re: [Winpcap-users] Multiple instances
>
> Could you use a single filter with 'OR' statements to fulfill the 200 
> conditions you wish to capture for?  Then, handle the resulting packets in 
> your own application?  Or will the 200 conditions just get every packet 
> anyway?
>
> Could you describe what your application is trying to do?
>
> DC
>
> ----- Original Message ----- 
> From: "pro2c" <pro2c at litrca.com>
> To: <winpcap-users at winpcap.org>
> Sent: Thursday, May 13, 2010 9:25 AM
> Subject: Re: [Winpcap-users] Multiple instances
>
>
>   
>> It's developed in VB.NET 2.0
>> I optimized as far as I could. Maybe .NET is not a fast platform.
>> Can send source code to someone who can do VB
>>
>>
>> -----Original Message-----
>> From: winpcap-users-bounces at winpcap.org
>> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
>> Sent: Thursday, May 13, 2010 6:13 PM
>> To: winpcap-users at winpcap.org
>> Subject: Re: [Winpcap-users] Multiple instances
>>
>> A packet flow if 1.5MB/s is really low. The problem was probably in the
>> logic of your application. If I were you, I would definitely review your
>> application design to understand what the bottleneck was.
>>
>> Have a nice day
>> GV
>>
>> --------------------------------------------------
>> From: "pro2c" <pro2c at litrca.com>
>> Sent: Thursday, May 13, 2010 9:02 AM
>> To: <winpcap-users at winpcap.org>
>> Subject: Re: [Winpcap-users] Multiple instances
>>
>>     
>>> Yes, this was my first attempt but at full DL speed (~1,5 MB/s) the CPU
>>> usage was to high :( since the packet flow is too large/fast
>>>
>>>
>>> -----Original Message-----
>>> From: winpcap-users-bounces at winpcap.org
>>> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
>>> Sent: Thursday, May 13, 2010 4:59 PM
>>> To: winpcap-users at winpcap.org
>>> Subject: Re: [Winpcap-users] Multiple instances
>>>
>>> If memory is an issue, then the best solution is opening a single 
>>> instance
>>> of the WinPcap device, and do your own filtering and demultiplexing in
>>> user
>>> mode. This could have the good side effect of having less kernel-user 
>>> mode
>>> transitions to bring the packets to user mode applications.
>>>
>>> Have a nice day
>>> GV
>>>
>>> --------------------------------------------------
>>> From: "pro2c" <pro2c at litrca.com>
>>> Sent: Thursday, May 13, 2010 5:37 AM
>>> To: <winpcap-users at winpcap.org>
>>> Subject: Re: [Winpcap-users] Multiple instances
>>>
>>>       
>>>> No, not 200 instances of my app but 200 instances of winpcap device to
>>>> have
>>>> 200 different filters (for each port).
>>>>
>>>>
>>>> -----Original Message-----
>>>> From: winpcap-users-bounces at winpcap.org
>>>> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of David Chang
>>>> Sent: Wednesday, May 12, 2010 10:08 PM
>>>> To: winpcap-users at winpcap.org
>>>> Subject: Re: [Winpcap-users] Multiple instances
>>>>
>>>> Why are you running 200 instances of your application on a single
>>>> computer?  Do you have 200 NICs?  Maybe you can change your application
>>>> to do more processing in one instance (i.e. multi-threading).
>>>>
>>>> DC
>>>>
>>>> pro2c wrote:
>>>>         
>>>>> I'm having some problems with multiple instances. When I load 200
>>>>> instances the memory use of my app reaches 100MB. I'm guessing that
>>>>> every instance reserves some mem for itself.
>>>>>
>>>>> Can this be lowered somehow?
>>>>>
>>>>>
>>>>>           
> ------------------------------------------------------------------------
>   
>>>>> _______________________________________________
>>>>> Winpcap-users mailing list
>>>>> Winpcap-users at winpcap.org
>>>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>>>
>>>>>           
>>>> _______________________________________________
>>>> Winpcap-users mailing list
>>>> Winpcap-users at winpcap.org
>>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>>
>>>> _______________________________________________
>>>> Winpcap-users mailing list
>>>> Winpcap-users at winpcap.org
>>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>>         
>>> _______________________________________________
>>> Winpcap-users mailing list
>>> Winpcap-users at winpcap.org
>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>
>>> _______________________________________________
>>> Winpcap-users mailing list
>>> Winpcap-users at winpcap.org
>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>       
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>
>>     
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>