<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:v =
"urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:st1 =
"urn:schemas-microsoft-com:office:smarttags"><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-2">
<META content="MSHTML 6.00.6000.16640" name=GENERATOR><!--[if !mso]>
<STYLE>v\:* {
BEHAVIOR: url(#default#VML)
}
o\:* {
BEHAVIOR: url(#default#VML)
}
w\:* {
BEHAVIOR: url(#default#VML)
}
.shape {
BEHAVIOR: url(#default#VML)
}
</STYLE>
<![endif]--><o:SmartTagType name="country-region"
namespaceuri="urn:schemas-microsoft-com:office:smarttags"></o:SmartTagType><o:SmartTagType
name="City"
namespaceuri="urn:schemas-microsoft-com:office:smarttags"></o:SmartTagType><o:SmartTagType
name="PostalCode"
namespaceuri="urn:schemas-microsoft-com:office:smarttags"></o:SmartTagType><o:SmartTagType
name="place"
namespaceuri="urn:schemas-microsoft-com:office:smarttags"></o:SmartTagType><!--[if !mso]>
<STYLE>
st1\:*{behavior:url(#default#ieooui) }
</STYLE>
<![endif]-->
<STYLE>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.emailstyle20
{font-family:Arial;
color:navy;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</STYLE>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></HEAD>
<BODY lang=EN-US vLink=purple link=blue bgColor=white>
<DIV><FONT face="Courier New" size=2>Well... Wireshark is slow at capturing on
high speed networks (i.e. it cannot keep up), but dumpcap is definitely fast. As
a matter of fact, dumpcat is extremely tiny, and just dumps the packets to disk
without any whatsoever processing. In the case of dumpcap, the bottleneck is the
disk. You said that you were able to capture 900mbps to file (I suppose the
whole packet) over a long period of time. Where you using RAID or just a normal
disk?</FONT></DIV>
<DIV><FONT face="Courier New" size=2></FONT> </DIV>
<DIV><FONT face="Courier New" size=2>Have a nice day</FONT></DIV>
<DIV><FONT face="Courier New" size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=tom.gibson@ipvidnet.com href="mailto:tom.gibson@ipvidnet.com">Tom
Gibson</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Wednesday, April 30, 2008 4:55
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> RE: [Winpcap-users] Can winpcap
capture that fast?</DIV>
<DIV><BR></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">I was pleasantly
surprised how fast it is. I had good results using the cmd line tool
that comes in wireshark’s program folder (dumpcap I think it was). I was
able to capture 900mbp/s to a file over a long period of time. I just
set my buffer high and it worked. When capturing a lot (100’s of gigs) I
found I needed to record to multiple files otherwise it would start dropping
packets. This was on a Quadcore system (I’m guessing a dual core would
have worked about the same) with a 4 drive raid0 array. Note though,
this was network data where almost all of the packets were ~1500 bytes.
Also the NIC / driver you use could make a real difference at high
speeds. Intel looks like they have a good driver, but I haven’t done
testing with other NICs to compare. <o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Tom<o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"><o:p> </o:p></SPAN></FONT></P>
<DIV>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">
<HR tabIndex=-1 align=center width="100%" SIZE=2>
</SPAN></FONT></DIV>
<P class=MsoNormal><B><FONT face=Tahoma size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">From:</SPAN></FONT></B><FONT
face=Tahoma size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org]
<B><SPAN style="FONT-WEIGHT: bold">On Behalf Of </SPAN></B>Gianluca
Varenni<BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Wednesday,
April 30, 2008 3:02 PM<BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B>
winpcap-users@winpcap.org<BR><B><SPAN
style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re: [Winpcap-users] Can winpcap
capture that fast?</SPAN></FONT><o:p></o:p></P></DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P>
<DIV>
<P class=MsoNormal><FONT face="Courier New" size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Courier New'">It all depends on what you
are doing in your application. Forget about using wireshark for high
performance capture. It's *not* the right tool. In case of high speed
networks, the solutions are usually</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Courier New" size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Courier New'">- having your custom
application that analyzes the packets -or-</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Courier New" size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Courier New'">- dumping packets to disk
using HW RAID in striping mode.</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"> <o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Courier New" size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Courier New'">Hope it
helps</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Courier New" size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Courier New'">GV</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"> <o:p></o:p></SPAN></FONT></P></DIV>
<BLOCKQUOTE
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 4pt; PADDING-BOTTOM: 0in; MARGIN: 5pt 0in 5pt 3.75pt; BORDER-LEFT: black 1.5pt solid; PADDING-TOP: 0in; BORDER-BOTTOM: medium none">
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">----- Original Message -----
<o:p></o:p></SPAN></FONT></P></DIV>
<DIV style="font-color: black">
<P class=MsoNormal style="BACKGROUND: #e4e4e4"><B><FONT face=Arial
size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Arial">From:</SPAN></FONT></B><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> <A
title=Srinivas.Voora@etalk.com href="mailto:Srinivas.Voora@etalk.com">Voora,
Srinivas</A> <o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><B><FONT face=Arial size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Arial">To:</SPAN></FONT></B><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
<o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><B><FONT face=Arial size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Arial">Sent:</SPAN></FONT></B><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
Wednesday, April 30, 2008 5:49 AM<o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><B><FONT face=Arial size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Arial">Subject:</SPAN></FONT></B><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> RE:
[Winpcap-users] Can winpcap capture that
fast?<o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"><o:p> </o:p></SPAN></FONT></P></DIV>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">We have see
happening with our application as well with the Wire shark. After hitting
20000 packet/sec it becomes kind of stagnant. There is a site recently we
were able to handle 80000 packets/sec on gigabit port. I did not have a
chance to see what the difference was. </SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"> <o:p></o:p></SPAN></FONT></P>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Tahoma size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">-----Original
Message-----<BR><B><SPAN style="FONT-WEIGHT: bold">From:</SPAN></B> <A
href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</A>
[mailto:winpcap-users-bounces@winpcap.org] <B><SPAN
style="FONT-WEIGHT: bold">On Behalf Of </SPAN></B>Zafer SAVAS<BR><B><SPAN
style="FONT-WEIGHT: bold">Sent:</SPAN></B> Wednesday, April 30, 2008 5:58
AM<BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B>
winpcap-users@winpcap.org<BR><B><SPAN
style="FONT-WEIGHT: bold">Subject:</SPAN></B> YNT: [Winpcap-users] Can
winpcap capture that fast?</SPAN></FONT><o:p></o:p></P>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"> <o:p></o:p></SPAN></FONT></P>
<DIV id=idOWAReplyText67005>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Arial color=black
size=2><SPAN style="FONT-SIZE: 10pt; COLOR: black; FONT-FAMILY: Arial">Hello
Ian and Gianluca,</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Thanks for the replies. Here is
the summary for what I have done after your
responses:</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">- I have built a win32
application with visual C++ and listened for the incoming packet. The code
segment for listening is just a for while loop with pcap_next_ex() function
and when a packet arrives a counter is incremented. Thats all, no displaying
or saving to disk. As a result only 20K of the packets are captured.
</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Again I am able to see that
about 400.000 packets are received on the LAN status window in the system
tray which means the NIC has captured them succesfully, but I can capture
very small amount of it.</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN
style="FONT-SIZE: 12pt"> <o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">I am really suprised that only
small amount of the packets are captured by the
driver?</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Do you have any other
suggestions? or has some ever tried to capture large amount of
packets/second (e.g : 60K packets/sec) using
winpcap?</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN
style="FONT-SIZE: 12pt"> <o:p></o:p></SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Best
Regards</SPAN></FONT><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Zafer
SAVAS</SPAN></FONT><o:p></o:p></P></DIV></DIV>
<DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman"
size=3><SPAN style="FONT-SIZE: 12pt"> <o:p></o:p></SPAN></FONT></P>
<DIV style="MARGIN-LEFT: 0.5in">
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">
<HR align=center width="100%" SIZE=2>
</SPAN></FONT></DIV></DIV>
<P class=MsoNormal
style="MARGIN-BOTTOM: 12pt; MARGIN-LEFT: 0.5in; MARGIN-RIGHT: 0in; mso-margin-top-alt: 0in"><B><FONT
face=Tahoma size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">Kimden:</SPAN></FONT></B><FONT
face=Tahoma size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma"> Ian
Hawley<BR><B><SPAN style="FONT-WEIGHT: bold">Gönderilmiş:</SPAN></B> Sal
29.04.2008 19:26<BR><B><SPAN style="FONT-WEIGHT: bold">Kime:</SPAN></B>
winpcap-users@winpcap.org<BR><B><SPAN
style="FONT-WEIGHT: bold">Konu:</SPAN></B> RE: [Winpcap-users] Can winpcap
capture that fast?</SPAN></FONT><o:p></o:p></P></DIV>
<DIV><PRE style="MARGIN-LEFT: 0.5in; WORD-WRAP: break-word"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">*** Before acting on this email you are advised to read the information at the end of this email. ***<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">--------------------------------------------------------------------------<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">In my experience of recording large volumes of network traffic it is<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">essential to hand off the packets to a secondary buffer in RAM and have<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">another thread consume the data and write it to disk. I don't even have<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">any logging in my capture thread, as it is synchronous, and experience<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">has shown me, that writing one line of text to a log file can stall a<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">thread for several seconds, depending on what the OS is doing.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Our volume of data is typically < 8Mbytes/second however in<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">~8500packets, so at the volumes you are examining you are going to<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">struggle, especially to get that volume of data through the various bus<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">bottle-necks and to disk. We use dedicated RAID cards with 512MB or<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">1024MB of cache.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Hope that helps<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Ian<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">-----Original Message-----<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">From: winpcap-users-bounces@winpcap.org<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">[mailto:winpcap-users-bounces@winpcap.org] On Behalf Of Gianluca Varenni<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Sent: 29 April 2008 17:00<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">To: winpcap-users@winpcap.org<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Subject: Re: [Winpcap-users] Can winpcap capture that fast?<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">You are probably losing packets because you are dumping to disk. Disks<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">are <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">**slow**, they cannot ususally keep up dumping 400k packets per second.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">I <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">would try creating a simple application that simply counts the packets<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">and <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">see if you keep losing packets.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">If you need to dump to disk, I suggest you looking at the slides of this<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">presentation<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">http://www.cacetech.com/SHARKFEST.08/BoF_Varenni_%20WinPcap%20Do's%20and<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">%20Don'ts.zip<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">In particular the slide titled "dumping to disk" gives some hints on it.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Have a nice day<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">GV<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">----- Original Message ----- <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">From: "Zafer SAVAS" <zsavas@aselsan.com.tr><o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">To: <winpcap-users@winpcap.org><o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Sent: Tuesday, April 29, 2008 6:46 AM<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Subject: [Winpcap-users] Can winpcap capture that fast?<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Hello,<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> I have a question about the recording capability of the Winpcap<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">library:<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> I want to monitor a gigabit ethernet link where a large amount of data<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">is <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> flowing (430.000 MAC Layer packets/second).<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> When I observe my network connection status for incoming and outgoing <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> packets using the windows LAN connection on the system tray, I see<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">that <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> exactly 430.000 packets are received. However when I want to record<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">them <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> using my c program, I can only record 20.000 of them.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> So, do you think I am doing something wrong or is this the maximum<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">speed <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> of the library?<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> P.S : I am already using the dump file utility of the library for fast<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> recording.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Best Regards<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Zafer<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> ######################################################################<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Dikkat:<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Bu elektronik posta mesaji kisisel ve ozeldir. <st1:City w:st="on"><st1:place w:st="on">Eger</st1:place></st1:City> size<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> gonderilmediyse lutfen gondericiyi bilgilendirip mesaji siliniz.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Firmamiza gelen ve giden mesajlar virus taramasindan gecirilmekte,<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> guvenlik nedeni ile kontrol edilerek saklanmaktadir. Mesajdaki<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> gorusler ve bakis acisi gondericiye ait olup Aselsan A.S. resmi<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> gorusu olmak zorunda degildir.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> ######################################################################<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Attention:<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> This e-mail message is privileged and confidential. If you are<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> not the intended recipient please delete the message and notify<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> the sender. E-mails to and from the company are monitored for<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> operational reasons and in accordance with lawful business practices.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Any views or opinions presented are solely those of the author and<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> do not necessarily represent the views of the company.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> ######################################################################<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">><o:p> </o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> _______________________________________________<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Winpcap-users mailing list<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> Winpcap-users@winpcap.org<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">> https://www.winpcap.org/mailman/listinfo/winpcap-users <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">_______________________________________________<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Winpcap-users mailing list<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Winpcap-users@winpcap.org<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">https://www.winpcap.org/mailman/listinfo/winpcap-users<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">--------------------------------------------------------------------------<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Please visit us at IFSEC 2008<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Stand 17111, Hall 19<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">NEC <st1:City w:st="on"><st1:place w:st="on">Birmingham</st1:place></st1:City> 12 - 15th May<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Register now to attend at http://www.ifsec.co.uk/register<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> 3-4 Broadfield Close, <st1:place w:st="on"><st1:City w:st="on">Sheffield</st1:City> <st1:PostalCode w:st="on">S8 0XN</st1:PostalCode>, <st1:country-region w:st="on">United Kingdom</st1:country-region></st1:place><o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Telephone +44 (0) 114 255 2509<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Facsimile +44 (0) 114 258 2050 <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Web Address http://www.synx.com/<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">--------------------------------------------------------------------------<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">This email is confidential and may also be legally privileged or exempt from disclosure under applicable law. It is intended solely for the use of the individual to whom it is addressed. If you are not the intended recipient, please destroy it immediately without reading the contents of the e-mail or opening attachments. Any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error please notify the sender by e-mail, telephone or fax. <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Replies to this e-mail may be monitored by Synectic Systems Group Limitedfor operational or business reasons, within the scope of the law.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Any opinions or information presented in this e-mail or any attachments that do not relate to the business of Synectic Systems Group Limited are solely those of the author and do not represent or are endorsed by Synectic Systems Group Limited. No contract may be construed by this e-mail or any attachments, unless specifically expressed therein.<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Security Warning: Internet communications are not guaranteed to be secure or virus-free. Except to the extent Synectic Systems Group Limited may not exclude its liability under law Synectic Systems Group Limited does not accept responsibility for any loss whatsoever arising from unauthorised access to, or interference with, any communications over the internet by any third party, or from the transmission of any viruses. <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Synectic Systems Group Limited, trading as Synectics Security Networks. Registered in <st1:country-region w:st="on">England</st1:country-region> & <st1:country-region w:st="on"><st1:place w:st="on">Wales</st1:place></st1:country-region>, No. 05815524 . Registered Office; 3-4 Broadfield Close, <st1:place w:st="on">Sheffield</st1:place> S8 0XN . VAT No. GB 417 0698 46<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">--------------------------------------------------------------------------<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt"> <o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">_______________________________________________<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Winpcap-users mailing list<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">Winpcap-users@winpcap.org<o:p></o:p></SPAN></FONT></PRE><PRE style="MARGIN-LEFT: 0.5in"><FONT face="Courier New" size=2><SPAN style="FONT-SIZE: 10pt">https://www.winpcap.org/mailman/listinfo/winpcap-users<o:p></o:p></SPAN></FONT></PRE></DIV>
<DIV style="MARGIN-LEFT: 0.5in">
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">
<HR align=center width="100%" SIZE=2>
</SPAN></FONT></DIV></DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><STRONG><B><FONT
face="Times New Roman" color=red size=3><SPAN
style="FONT-SIZE: 12pt; COLOR: red">Dikkat:</SPAN></FONT></B></STRONG><o:p></o:p></P>
<P style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">Bu elektronik posta mesaji kisisel ve ozeldir.
<st1:City w:st="on"><st1:place w:st="on">Eger</st1:place></st1:City> size
gonderilmediyse lutfen gondericiyi bilgilendirip mesaji siliniz.
Firmamiza gelen ve giden mesajlar virus taramasindan
gecirilmekte, guvenlik nedeni ile kontrol edilerek saklanmaktadir. Mesajdaki
gorusler ve bakis acisi gondericiye ait olup Aselsan A.S. resmi gorusu olmak
zorunda degildir.<o:p></o:p></SPAN></FONT></P>
<DIV style="MARGIN-LEFT: 0.5in">
<DIV class=MsoNormal style="TEXT-ALIGN: center"
align=center><STRONG><B><FONT face="Times New Roman" color=red size=3><SPAN
style="FONT-WEIGHT: normal; FONT-SIZE: 12pt; COLOR: red">
<HR align=center width="100%" SIZE=2>
</SPAN></FONT></B></STRONG></DIV></DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><STRONG><B><FONT
face="Times New Roman" color=red size=3><SPAN
style="FONT-SIZE: 12pt; COLOR: red">Attention:
</SPAN></FONT></B></STRONG><o:p></o:p></P>
<P style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">This e-mail message is privileged and confidential.
If you are not the intended recipient please delete the message and notify
the sender. E-mails to and from the company are monitored for operational
reasons and in accordance with lawful business practices. Any views or
opinions presented are solely those of the author and do not necessarily
represent the views of the company.<o:p></o:p></SPAN></FONT></P>
<DIV style="MARGIN-LEFT: 0.5in">
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">
<HR align=center width="100%" SIZE=2>
</SPAN></FONT></DIV></DIV>
<P style="MARGIN-LEFT: 0.5in"><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"> <o:p></o:p></SPAN></FONT></P>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">
<HR align=center width="100%" SIZE=2>
</SPAN></FONT></DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<o:p></o:p></SPAN></FONT></P></BLOCKQUOTE></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>