<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:v =
"urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:m =
"http://schemas.microsoft.com/office/2004/12/omml"><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16735" name=GENERATOR><!--[if !mso]>
<STYLE>v\:* {
BEHAVIOR: url(#default#VML)
}
o\:* {
BEHAVIOR: url(#default#VML)
}
w\:* {
BEHAVIOR: url(#default#VML)
}
.shape {
BEHAVIOR: url(#default#VML)
}
</STYLE>
<![endif]-->
<STYLE>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page Section1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.Section1
{page:Section1;}
-->
</STYLE>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></HEAD>
<BODY lang=EN-GB vLink=purple link=blue bgColor=white>
<DIV><FONT size=2>The only thing I can think of is that you were trying to
transmit packets that were too big. Otherwise I don't know exactly why it might
be failing. Are you sending the packets from multiple threads on the same pcap_t
handle?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=Tony.Ballardie@global-mix.com
href="mailto:Tony.Ballardie@global-mix.com">Tony Ballardie</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, October 13, 2008 1:48
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> RE: [Winpcap-users] winpcap
4.0.2 possible packet loss?</DIV>
<DIV><BR></DIV>
<DIV class=Section1>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Well the issue *<B>may</B>* be
a red-herring. I was using a Microsoft Remote Desktop connection and
monitoring packet receive statistics in the Windows media player. Apparently
WM player stats viewed over RDP can be misleading.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Although the problem seemed to
manifest itself on Win Server 2003 and Server 2008 Enterprise Edition, on both
occasions the issue was only seen over Remote Desktop connections. So far
nobody was able to test it on the respective consoles. The network card on
both machines is a Broadcom NetXtreme Gigabit Ethernet.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Today I ran the same app on my
local XP PC and experienced zero packet loss. <o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">So perhaps this wasn’t an
issue after all? I will continue testing on XP and move onto other Microsoft
platforms in due course, when the issue *<B>may</B>* re-appear. Until then I’m
parking the issue, unless someone knows that it is a problem and can suggest a
fix?<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Thanks<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Tony<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Ps.which version of winpcap
should I use on Vista? I downloaded 4.0.2 and installed it but the app that’s
using it “failed to initialize pcap”.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #1f497d"><o:p> </o:p></SPAN></P>
<DIV>
<DIV
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; PADDING-LEFT: 0cm; PADDING-BOTTOM: 0cm; BORDER-LEFT: medium none; PADDING-TOP: 3pt; BORDER-BOTTOM: medium none">
<P class=MsoNormal><B><SPAN lang=EN-US
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Tahoma','sans-serif'">From:</SPAN></B><SPAN
lang=EN-US style="FONT-SIZE: 10pt; FONT-FAMILY: 'Tahoma','sans-serif'">
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org]
<B>On Behalf Of </B>Gianluca Varenni<BR><B>Sent:</B> 13 October 2008
21:20<BR><B>To:</B> winpcap-users@winpcap.org<BR><B>Subject:</B> Re:
[Winpcap-users] winpcap 4.0.2 possible packet
loss?<o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal><o:p> </o:p></P>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Times New Roman','serif'">Do you have
more details on the network card you are using (brand and model)?</SPAN><SPAN
style="FONT-SIZE: 12pt; FONT-FAMILY: 'Times New Roman','serif'"><o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-SIZE: 12pt; FONT-FAMILY: 'Times New Roman','serif'"> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Times New Roman','serif'">Have a nice
day</SPAN><SPAN
style="FONT-SIZE: 12pt; FONT-FAMILY: 'Times New Roman','serif'"><o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Times New Roman','serif'">GV</SPAN><SPAN
style="FONT-SIZE: 12pt; FONT-FAMILY: 'Times New Roman','serif'"><o:p></o:p></SPAN></P></DIV>
<BLOCKQUOTE
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0cm; BORDER-TOP: medium none; PADDING-LEFT: 4pt; PADDING-BOTTOM: 0cm; MARGIN: 5pt 0cm 5pt 3.75pt; BORDER-LEFT: black 1.5pt solid; PADDING-TOP: 0cm; BORDER-BOTTOM: medium none">
<DIV>
<P class=MsoNormal><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'">----- Original
Message ----- <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal style="BACKGROUND: #e4e4e4"><B><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'">From:</SPAN></B><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'"> <A
title=Tony.Ballardie@global-mix.com
href="mailto:Tony.Ballardie@global-mix.com">Tony Ballardie</A>
<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><B><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'">To:</SPAN></B><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'"> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><B><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'">Sent:</SPAN></B><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'"> Friday, October
10, 2008 1:43 PM<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><B><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'">Subject:</SPAN></B><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Arial','sans-serif'"> RE:
[Winpcap-users] winpcap 4.0.2 possible packet
loss?<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-SIZE: 12pt; FONT-FAMILY: 'Times New Roman','serif'"><o:p> </o:p></SPAN></P></DIV>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Some more information on
this issue...<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">The function
‘pcap_sendpacket’ is failing up to 40% of the time when sending the
streaming multicast packets to the kernel.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Is this a known issue, and
is there a fix??<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0">Tony<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #0070c0"><o:p> </o:p></SPAN></P>
<DIV
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0cm; BORDER-TOP: medium none; PADDING-LEFT: 4pt; PADDING-BOTTOM: 0cm; BORDER-LEFT: blue 1.5pt solid; PADDING-TOP: 0cm; BORDER-BOTTOM: medium none">
<DIV>
<DIV
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0cm; BORDER-TOP: #b5c4df 1pt solid; PADDING-LEFT: 0cm; PADDING-BOTTOM: 0cm; BORDER-LEFT: medium none; PADDING-TOP: 3pt; BORDER-BOTTOM: medium none">
<P class=MsoNormal><B><SPAN lang=EN-US
style="FONT-SIZE: 10pt; FONT-FAMILY: 'Tahoma','sans-serif'">From:</SPAN></B><SPAN
lang=EN-US style="FONT-SIZE: 10pt; FONT-FAMILY: 'Tahoma','sans-serif'"> <A
href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</A>
[mailto:winpcap-users-bounces@winpcap.org] <B>On Behalf Of </B>Tony
Ballardie<BR><B>Sent:</B> 10 October 2008 12:21<BR><B>To:</B>
winpcap-users@winpcap.org<BR><B>Subject:</B> [Winpcap-users] winpcap 4.0.2
possible packet loss?<o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Hi,<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Winpcap 4.0.2 is being used on a Windows Server 2008 box
to capture UDP-tunnelled streaming media (IP multicast) packets and then
present de-capsulated/original multicasts for playback in windows media
player on box. Depending on the stream, the bitrate may be 500-600kbps.
<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>The underlying multicast packets are being IP fragmented
at source, so each fragment is UDP-tunnelled so arrives as its own UDP
packet, becoming an IP fragment after tunnel decapsulation. <o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>I’m not the developer here but I’m presuming once the
tunnelled packets are decapsulated they are written back to NPF for
subsequent presentation to the IP layer and normal IP
processing.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>The on-box media player is showing up to 40% packet loss
and wonder if this could be due to the NPF not being capable somehow of
processing packets under these higher bitrate conditions? The path between
source and receiver is just a single-hop LAN and I’m confident the packet
loss is not happening in the network.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Or perhaps certain parameters need setting
accordingly?<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>The network adapter is a Broadcom NetXtreme Gigabit
Ethernet adapter.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Any suggestions would be greatly
appreciated.<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Thanks<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P>
<P class=MsoNormal>Tony<o:p></o:p></P>
<P class=MsoNormal><o:p> </o:p></P></DIV>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><SPAN
style="FONT-SIZE: 12pt; FONT-FAMILY: 'Times New Roman','serif'">
<HR align=center width="100%" SIZE=2>
</SPAN></DIV>
<P class=MsoNormal><SPAN
style="FONT-SIZE: 12pt; FONT-FAMILY: 'Times New Roman','serif'">_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<o:p></o:p></SPAN></P></BLOCKQUOTE></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>