[Winpcap-users] 答复: Re: About the packets loss , what is the bottleneck ?

Fri Oct 1 15:27:55 PDT 2010

 1) not at the moment.
2) not at the moment.

As I said, if the problem is the number of copies, you would see the dropped packet count different from zero. 

Did you try with another network card not integrated on the MoBo? What is the network card on your motherboard?

Have a nice day
GV

From: liu.yulou at zte.com.cn 
Sent: Wednesday, September 29, 2010 5:42 PM
To: winpcap-users at winpcap.org 
Cc: winpcap-users at winpcap.org ; winpcap-users-bounces at winpcap.org 
Subject: [Winpcap-users] 答复: Re: About the packets loss , what is the bottleneck ?

thank you for the answer. there are two questions : 

1.   is it possible to copy data directly from the kernel buffer to the final buffer (  which I want the date kept  in) ?   
2. or is there any way that programmer can modify the address of the user buffer directly? 

thank you. 

Yulou 

      "Gianluca Varenni" <gianluca.varenni at cacetech.com> 
      发件人:  winpcap-users-bounces at winpcap.org 
      2010-09-21 07:45 请答复 给
            winpcap-users at winpcap.org 

     收件人 <winpcap-users at winpcap.org>  
            抄送  
            主题 Re: [Winpcap-users] About the packets loss ,        what is the bottleneck ? 

Two notes: 

1. if the objective is dumping the packets to disk, then the bottleneck is mostly the disk. 
2. checksum offloading does not play any role in packet capture. It plays a role when packets have to be processed by the TCP/IP stack (because the validation is done in hardware rather software). But when you do packet capture, you don't care about that. In fact I suggested to totally disable TCP/IP from the NIC where you capture the packets from. 

GV 

From: "Fish" (David B. Trout) 
Sent: Sunday, September 19, 2010 4:44 AM 
To: winpcap-users at winpcap.org 
Subject: Re: [Winpcap-users] About the packets loss ,what is the bottleneck ? 

There are other factors as well: 

1.       Number of processors and processor speed. 
2.       Amount of RAM 
3.       Operating system workload 
4.       Network Adapter Task Offloading capability (esp. checksum offloading) 
5.       Speed of disk subsystem 

On an modern fast quad-core system that is relatively idle (has no other work to do) with lots of RAM and a high performance multi-disk RAID-0 array and with checksum offloading enabled in the adapter, it should be entirely possible to capture a gigabit speed without packet loss. 

If your system is an overtaxed (busy) single processor system with only an average amount of RAM and an average speed non-RAID disk subsystem however, then you’re very likely going to experience significant packet loss beyond about 480 Mbps. 
-- 
 "Fish"  (David B. Trout) 
   fish at softdevlabs.com 

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of yulou liu
Sent: Sunday, September 19, 2010 12:50 AM
To: winpcap-users at winpcap.org
Subject: [Winpcap-users] About the packets loss , what is the bottleneck ?
Importance: High 

There is still the question about packets loss.

According to the essay  ' Profiling and Optimization of Software-Based Network-Analysis Applications' ,    every packet is copied twice in the main memory before reaching the user.  In order to reduce the cost of CPU and the bus occupying of the SDRAM of pc,   is it possible to copy data directly from the kernel buffer to the final buffer ,  which I want the date kept  in ?   

Here is another idea ---  allocate several different user buffers , once a user buffer is fulled , then let the next user buffer to save the new datas from kernel buffer.  Meanwhile copy datas from the first user buffer to disk (assume that the hard disk write rate is fast enough).  Is this idea work with the winpcap ? 

Thank you! 

============================================================== 

Q1: tough question to answer, as it depends on a number of factors. What is the average packet size? Are you just counting the packets, or dumping them to disk/DB/...? Do you see packet drops in the pcap_stats?
Q2: I will need to run some tests on this. Do you have some minimal sample code that shows the issue?
Q3: Yes, *if* the NIC (and NIC driver) are not dropping packets themselves. 

Did you disable any protocol bound to the NIC where you receive all these packets?

Have a nice day
GV

From: yulou liu 
Sent: Wednesday, August 25, 2010 11:08 AM
To: winpcap 
Subject: [Winpcap-users] About the packets loss , what is the bottleneck ?

I'm using winpcap to capture datas from FPGA board via 1G Ethernet connection(directly connected).
the FPGA is configed to send data at a special rate. With the fpga sending  rate increases,especially above 500Mbps, it sometimes loss packets. 

Q1:  Is it possible to totally avoid packets loss by optimism the code?  I want to collect datas at speed 614Mbps without packet loss (collecting all datas 

last about 1 minutes). My workstations features with 2 Xeon CPU (each has 4core), DDR3 SDRAM, 1 G onboard  netcard.  Which part is the most probably bottleneck ?

Q2: As a test ,  I found the pcap_next_ex() can't get any packets  when the user buffer is set over 64 MB,  what does it happen ?

Q3: if the Kernel buffer's size is 16MB , then the first 16Mb packets from fpga won't be lost,  so ,  if I set the kernel buffer as 128MB ,  then at least 

the first coming 128MB data from FPGA won't be lost either ?  but I found When I set the kernel buffer bigger than 100 MB, the packets drops is getting 

worse.  

Thanks a lot!

--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.
This message has been scanned for viruses and Spam by ZTE Anti-Spam system.

--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20101001/e0f4524a/attachment-0001.htm 