<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3157" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV dir=ltr align=left><SPAN class=870415722-07122007><FONT face=Arial
color=#0000ff size=2>Thanks GV.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=870415722-07122007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=870415722-07122007><FONT face=Arial
color=#0000ff size=2>Is the callback function called immediately when a stat
report is compiled?</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=870415722-07122007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV dir=ltr align=left><SPAN class=870415722-07122007><FONT face=Arial
color=#0000ff size=2>The reason I ask is: if I have a 100ms sample time and use
a system timer to log when the callback is called it is pretty reliably every
100ms, but when I log the report header timestamps they are mainly every 100ms,
but occasionally 800ms or -600ms!</FONT></SPAN></DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff size=2>As an
example:</FONT></SPAN></DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff size=2>Report
header time/ packets in report
/ difference from last header time</FONT></SPAN></DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff
size=2>1197065236.922320
64
103.069782<BR>1197065237.228180
62
305.860043<BR>1197065237.132800
67
-95.379829<BR>1197065237.242820
68
110.019922<BR>1197065237.343190
63
100.369930<BR>1197065237.450960
67 107.769966<BR>1197065237.553170
64
102.210045<BR>1197065237.653380
62
100.209951<BR>1197065237.753430
62
100.049973<BR>1197065237.853580
62
100.150108<BR>1197065237.953730
62 100.150108<BR>1197065238.538680
61 584.949970<BR>1197065238.154090
62 -384.590149<BR>1197065238.254160
61 100.070000<BR>1197065238.364150
63 109.990120<BR>1197065238.464530
64 100.379944<BR>1197065238.564680
62 100.150108<BR>1197065238.664820
62
100.139856<BR>1197065238.764970
62 100.150108</FONT></SPAN></DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff size=2>I am
stressing it by flooding the captured address with lots of large udp packets,
but can you think why I would occasionally be seeing that the report was 3* or
5* a capture period from the last one, or maybe 3* a capture period before
it?</FONT></SPAN></DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff size=2>Even
if I sort the reports by header time, it's still not reliably every
100ms.</FONT></SPAN></DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff
size=2>Thanks,</FONT></SPAN></DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=870415722-07122007><FONT face=Arial color=#0000ff
size=2>Jonathan</FONT></SPAN></DIV>
<DIV dir=ltr align=left><BR></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] <B>On Behalf Of </B>Gianluca
Varenni<BR><B>Sent:</B> Friday, December 07, 2007 3:56 PM<BR><B>To:</B>
winpcap-users@winpcap.org<BR><B>Subject:</B> Re: [Winpcap-users]
MODE_STAT<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT size=2>The timestamp is generated when the stat reports are
computed in the driver.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>While in the callback function, the packets are buffered by
the kernel buffer managed by the WinPcap kernel driver, npf.sys. In particular,
if you are in statistical mode, packets are not actually buffered at all, the
driver receives the packets from the OS, updates the statistics and releases the
packet. This update is completely independent from the callback
function.</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=Jonathan.Fitt@anritsu.com
href="mailto:Jonathan.Fitt@anritsu.com">Fitt, Jonathan</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Thursday, December 06, 2007 2:11
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] MODE_STAT</DIV>
<DIV><BR></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>My question is
about using pcap in statistical mode.</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>The timeval
attached to the stat report header, when exactly is that
time?</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>Is it the time the
capture started, or timed out?</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>Also, while in the
callback function are all packets received/sent buffered up so that they'll
appear in the next report?</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial size=2>I don't want to
miss any while in the callback function.</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2>Thanks,</FONT></SPAN></DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=840550722-06122007><FONT face=Arial
size=2>Jonathan</FONT></SPAN></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>