<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-GB link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><span style='color:#0070C0'>Well the issue *<b>may</b>* be a
red-herring. I was using a Microsoft Remote Desktop connection and monitoring
packet receive statistics in the Windows media player. Apparently WM player
stats viewed over RDP can be misleading.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>Although the problem seemed to
manifest itself on Win Server 2003 and Server 2008 Enterprise Edition, on both
occasions the issue was only seen over Remote Desktop connections. So far nobody
was able to test it on the respective consoles. The network card on both
machines is a Broadcom NetXtreme Gigabit Ethernet.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>Today I ran the same app on my
local XP PC and experienced zero packet loss. <o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>So perhaps this wasn’t an
issue after all? I will continue testing on XP and move onto other Microsoft
platforms in due course, when the issue *<b>may</b>* re-appear. Until then I’m
parking the issue, unless someone knows that it is a problem and can suggest a
fix?<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>Thanks<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>Tony<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>Ps.which version of winpcap
should I use on Vista? I downloaded 4.0.2 and installed it but the app that’s
using it “failed to initialize pcap”.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>
<p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:
"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'> winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] <b>On Behalf Of </b>Gianluca Varenni<br>
<b>Sent:</b> 13 October 2008 21:20<br>
<b>To:</b> winpcap-users@winpcap.org<br>
<b>Subject:</b> Re: [Winpcap-users] winpcap 4.0.2 possible packet loss?<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Times New Roman","serif"'>Do
you have more details on the network card you are using (brand and model)?</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Times New Roman","serif"'>Have
a nice day</span><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Times New Roman","serif"'>GV</span><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0cm 0cm 0cm 4.0pt;
margin-left:3.75pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>-----
Original Message ----- <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal style='background:#E4E4E4'><b><span style='font-size:10.0pt;
font-family:"Arial","sans-serif"'>From:</span></b><span style='font-size:10.0pt;
font-family:"Arial","sans-serif"'> <a
href="mailto:Tony.Ballardie@global-mix.com"
title="Tony.Ballardie@global-mix.com">Tony Ballardie</a> <o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>To:</span></b><span
style='font-size:10.0pt;font-family:"Arial","sans-serif"'> <a
href="mailto:winpcap-users@winpcap.org" title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>
<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Sent:</span></b><span
style='font-size:10.0pt;font-family:"Arial","sans-serif"'> Friday, October 10,
2008 1:43 PM<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Subject:</span></b><span
style='font-size:10.0pt;font-family:"Arial","sans-serif"'> RE: [Winpcap-users]
winpcap 4.0.2 possible packet loss?<o:p></o:p></span></p>
</div>
<div>
<p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p>
</div>
<p class=MsoNormal><span style='color:#0070C0'>Some more information on this
issue...<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>The function
‘pcap_sendpacket’ is failing up to 40% of the time when sending the
streaming multicast packets to the kernel.<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>Is this a known issue, and is
there a fix??<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'>Tony<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#0070C0'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'>
<p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:
"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;
font-family:"Tahoma","sans-serif"'> <a
href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</a>
[mailto:winpcap-users-bounces@winpcap.org] <b>On Behalf Of </b>Tony Ballardie<br>
<b>Sent:</b> 10 October 2008 12:21<br>
<b>To:</b> winpcap-users@winpcap.org<br>
<b>Subject:</b> [Winpcap-users] winpcap 4.0.2 possible packet loss?<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Hi,<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Winpcap 4.0.2 is being used on a Windows Server 2008 box to
capture UDP-tunnelled streaming media (IP multicast) packets and then present
de-capsulated/original multicasts for playback in windows media player on box.
Depending on the stream, the bitrate may be 500-600kbps. <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>The underlying multicast packets are being IP fragmented at
source, so each fragment is UDP-tunnelled so arrives as its own UDP packet,
becoming an IP fragment after tunnel decapsulation. <o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I’m not the developer here but I’m presuming
once the tunnelled packets are decapsulated they are written back to NPF for
subsequent presentation to the IP layer and normal IP processing.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>The on-box media player is showing up to 40% packet loss and
wonder if this could be due to the NPF not being capable somehow of processing
packets under these higher bitrate conditions? The path between source and
receiver is just a single-hop LAN and I’m confident the packet loss is
not happening in the network.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Or perhaps certain parameters need setting accordingly?<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>The network adapter is a Broadcom NetXtreme Gigabit Ethernet
adapter.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Any suggestions would be greatly appreciated.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Thanks<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Tony<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
</div>
<div class=MsoNormal align=center style='text-align:center'><span
style='font-size:12.0pt;font-family:"Times New Roman","serif"'>
<hr size=2 width="100%" align=center>
</span></div>
<p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'>_______________________________________________<br>
Winpcap-users mailing list<br>
Winpcap-users@winpcap.org<br>
https://www.winpcap.org/mailman/listinfo/winpcap-users<o:p></o:p></span></p>
</blockquote>
</div>
</body>
</html>