[Winpcap-users] WinPCAP packets capture delay..

[Black, Michael (IS)]

I see delays in your 10mbit_130byte file
 
Doing this:\windump -n -ttt -q -r  10mbit_130byte.pcap | cut -f1 -d" " >ttt10.csv
And plotting the results shows a very spikey plot.
 
Varies from almost 0 to 300+ microseconds.
 
Average is about 150 microseconds but there are regular excursions to over 200  microseconds.
 
So you're already seeing delays at 10mbit -- you just never fill up the buffers.
 
Doing the same plot for 100mbit_130byte shows a first spike to 339us at packet 10143.
There's your "10,000 packets runs OK".
 
Your 100mbit_640byte first spikes at packet#6733.  Bigger packets, earlier slowdown.  Then this file shows the average packet delay jumps from 156 to 171 at packet#7142 or so.  Then you have regular excursions down to almost 0 for the remaining time and a few excursions to 300+.
 
The 100mbit_60byte is interesting.  50us average through packet 1371 with lots of 0-excursions.  Then the average drops to 38us with fewer excursions to 0, then jumps to a dual-mode 150/160 us delay with regular 0-excursions.
 
 
 
Michael D. Black
Senior Scientist
Advanced Analytics Directorate
Northrop Grumman Information Systems
 

________________________________

From: winpcap-users-bounces at winpcap.org on behalf of Alimjan Kuramshin
Sent: Thu 9/23/2010 10:26 AM
To: winpcap-users at winpcap.org
Subject: EXTERNAL:Re: [Winpcap-users] WinPCAP packets capture delay..



Hello, David! Thanks for Your test and attention.



	Okay, I have done some of my own testing with 10,000 packets I am not seeing
	any delay at all.
	
	Without 100,000 packets however, I am seeing some periodic delays.
	
	HOWEVER...
	
	My test is not good. It is not the same test as yours.
	
	I do not have an oscilloscope so I cannot know if the packets are being SENT
	without delay. I suspect they are.
	
	I suspect the delay I am seeing with my test is from the SENDING machine,
	not on the receiving/capturing machine.
	
	So my test in inconclusive. It proves nothing.
	
	Alimjan, are you absolutely certain there is no delay sending? Does your
	oscilloscope have a "record" feature? Can you review your oscilloscope
	recording to verify there are zero delays? It is important!
	
	In other words, do you have ABSOLUTE *PROOF* that the packets are being SENT
	without delay?
	
	


I've done some test, and here is the results http://www.filefactory.com/file/b39ec4g/n/alimjan_kuramshin_winpcap_test.zip
Can You look at them? May be You can find some thing. Thank You a lot. You are so kind!

Bye..



-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/ms-tnef
Size: 6716 bytes
Desc: not available
Url : http://www.winpcap.org/pipermail/winpcap-users/attachments/20100923/20267c1a/attachment-0001.bin