[Winpcap-users] Yet another packetloss problem

[Reinhard, Dominik]

Hi,

 

I'm currently working on a stream analyzing tool using winpcap. Unfortunately I'm facing the fact of packetloss on my PC...

 

The Setup: 4 streams á 40Mbit/s over a 1GBit/s switch connected to my PC via 3Com 3C996B Gigabit or Intel 82567LM-3 Gigabit NIC (newest drivers of course). The system is powered by a Q9400 with plenty of ram. The CPU usage is below 20%, half of it is used by the kernel. The transport-protocol used is not known by windows, so the frames should not be processed any further.

 

While the hardware should be capable of receiving 160Mbit/s, I'm not able to receive all frames correctly by using Wireshark or my tool. As all frames are numbered, I can see nondeterministic drops of 0-10 frames per second on all streams (The frames are fixed size of 1060 byte).

 

As far as my application goes I tried optimizing kernel- & user-space buffers (both up to 50mb) and only reading the first 32 byte of every frame (pcap_open_live parameter). Also there was no difference between pcap_next_ex, pcap_loop and pcap_dispatch. pcap_stats_ex also tells me no frames have been dropped. The DPC latency without load is about 10µs, using Wireshark or my analyzer (default buffer) will raise the latency up to 30µs. Increasing the buffer size will raise the latency by factor 25. Also applying a filter and only capture one of the streams will result in packetloss...

 

Ideas, anyone?

 

Kind regards,

Dominik


**********************
** LEGAL DISCLAIMER **
**********************

This E-mail message and any attachments may contain 
legally privileged, confidential or proprietary 
information. If you are not the intended recipient(s),
or the employee or agent responsible for delivery of 
this message to the intended recipient(s), you are 
hereby notified that any dissemination, distribution 
or copying of this E-mail message is strictly 
prohibited. If you have received this message in 
error, please immediately notify the sender and 
delete this E-mail message from your computer.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110519/1a437735/attachment.html>