[Winpcap-users] pcap_next_ex starts returning timeout after 4+ hours of capture

Bekiares Tyrone-CTB041 Tyrone.Bekiares at motorolasolutions.com
Sat Feb 23 21:16:04 PST 2013

One further note:

This is a HP Z400 workstation running Win7SP1/64bit capturing from an Intel Gigabit CT2 desktop adapter.

The app itself is 32bit.


From: Bekiares Tyrone
Sent: Saturday, February 23, 2013 8:46 PM
To: 'winpcap-users at winpcap.org'
Subject: pcap_next_ex starts returning timeout after 4+ hours of capture


I'm using winpcap to capture a ~3mb/s stream of UDP packets. We need to capture for long periods (e.g., 24 hours); our application processes the payload, extracts statistics, and logs the statistics to disk over time. This usually works for about 4 or so hours, and then repeated calls to pcap_next_ex() return timeout (no data), and finally stop returning altogether (block). Notably, I'm certain data is still coming in (I can see it in wireshark).

The app is written in java, and I've written a JNI interface in VS2010 which bridges Java to the winpcap.dll API. I believe we are seeing the problem on a relatively modern HP workstation w/ built-in Intel GB/s NICs, under Win7/64, running WinPcap 4.1.2.

I open the device as follows:
pcap = pcap_open(adapterName, 65536,  PCAP_OPENFLAG_PROMISCUOUS,  1000,  NULL,  NULL);

I then set the following filter:
"(ip and udp) and (udp[8] & 0xEF = 0x80)" // RTP packets

I then continually call
and memcpy the resulting data into a reused memory buffer which is passed up to java through JNI NIO Direct Buffers.

This all works splendidly well until 4+ hours of capture, at which point pcap_next_ex() starts continually returning timeouts, and then eventually just blocks altogether.

I am not setting pcap_setmintocopy().

If I monitor the memory usage of my java process, there does not appear to be a memory leak.

Any ideas? Presumably, winpcap should support long captures without issue? Anyone experience something similar?


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20130224/14a3170e/attachment-0001.html>

More information about the Winpcap-users mailing list