<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1250">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:Arial;
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hello Everyone, apologies if you receive this email twice!<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>The company I work for has been using winpcap for some time now
and we recently noticed an issue which we thought might be NIC related but
could of course be WinPCap related as well and I thought I’d float it by the
mailing list and see if anyone was aware of an issue.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Basically we recording MPEG2 via a UDP packet stream from
proprietary hardware and after a period of time the machine enters a state
where the CPU usage is around 50+% and 50% if that usage is spent servicing DPC
requests according to perfmon.exe. We initially felt this might be the
NIC we are using but we have since recreated this by bombarding a different NIC
with UDP data through a test application and this has presented on that NIC
also. At present I am wondering whether it is an OS issue (we are running
Windows 2000 Service Pack 4 on many boxes) but I am also concerned it might be
our IBM Boxes and of course, our capture mechanism uses WinPCap and not
Winsock.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>The curious thing about this collapse of CPU is that it
appears to manifest around about the time when the host machine/application has
received 2^32 packets. Knowing the data rate we are sending to the box we
are able to predict quite accurately as to when the machine will enter this
state and it appears to suggest that some driver or piece of hardware or
windows itself is wrapping a 32bit counter and not handling the wrap correctly.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>We are presently trying various other network cards, Windows
XP and different PCs to see if we can get it to manifest but I wanted to ask
the WinPCap community if there was something that might go pop with such a
large volume of data? By accident we are using an oldish beta of WinPCap
3.0 but one of our engineers hasn’t seen any evidence that the release version
of 3.0 nor a subsequent version might fix this. We are however going to
set our test apps running on a similar box using WinPCap 3.1.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Note again that we have detached our proprietary hardware
from the PC and managed to generate the problem without using that hardware so
we are very confident that this has nothing to do with the issue. The
curious thing is that once the CPU has jumped into this state it does not
matter whether the data continues to be fed to the NIC; if you stop the
application that is bombarding the NIC with data, the CPU continues to be
stoically at the 50% mark. Curiously the number DPCs queued/second
appears to drop from what appears normal at circa 2000/second to around
40/second (this is while data is going into it, I have no metrics for when
there is no data atm). As strange is that if you unplug the NIC cable,
then the CPU drops back to ostensibly zero and the PC is happy again.
Plug the cable back in however and the CPU shoots back to 50%. Unplug the
cable from the PC and plug it into a hub with <i><span style='font-style:italic'>nothing
else attached </span></i>and it is still at 50%.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I would like to emphasize that the position we are in
presently means that we do not know if it is the IBM PCs we are using, the 3COM
NIC, some BIOS setting, the Operating System (Old systems are running 2K and we
are trying to see if it presents on XP) or some setting we have incorrect
somewhere, as unlikely as that might seem. I am not saying it is
definitely a WinPCap issue, but it would be very interesting if any of the
winpcap team or any winpcap user can<font color=navy><span style='color:navy'> </span></font>think
if a way that it <i><span style='font-style:italic'>might</span></i> be.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Any help would be greatly appreciated.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Kind Regards<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Ian Hawley<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>
<BR>
<P><FONT SIZE=2>--<BR>
No virus found in this outgoing message.<BR>
Checked by AVG Free Edition.<BR>
Version: 7.1.392 / Virus Database: 268.5.4/332 - Release Date: 04/05/2006<BR>
</FONT> </P><BR>
<P><FONT SIZE=2>--<BR>
No virus found in this outgoing message.<BR>
Checked by AVG Free Edition.<BR>
Version: 7.1.392 / Virus Database: 268.5.4/332 - Release Date: 04/05/2006<BR>
</FONT> </P>