<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<STYLE type=text/css>DIV {
MARGIN: 0px
}
</STYLE>
<META content="MSHTML 6.00.6000.16809" name=GENERATOR></HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=shrinivas_balulad@yahoo.co.in
href="mailto:shrinivas_balulad@yahoo.co.in">shrinivas balulad</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Tuesday, March 24, 2009 3:53
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users]
PacketReceivePacket is returning less thanMinToCopy bytes</DIV>
<DIV><BR></DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">
<DIV>Hi all,</DIV>
<DIV> </DIV>
<DIV>I am using winpcap 4.0.0.901.</DIV>
<DIV> </DIV>
<DIV>I am trying to capture traffic @ 270mbps.</DIV>
<DIV>OS - WindowsXP </DIV>
<DIV>machine - Intel Core 2 Quad CPU 2.4GHz, 4GB RAM</DIV>
<DIV>NIC - Intel(R) 82566DC-2 Gigabit Network </DIV>
<DIV> </DIV>
<DIV>for winpcap I have set PacketSetMinToCopy as 256k and
PacketSetReadTimeout is 1 sec.</DIV>
<DIV> </DIV>
<DIV>from mailing list and user manuals I learnt that
PacketReceivePacket() should return if either of below conditions is met</DIV>
<DIV>- MinToCopy bytes have been copied</DIV>
<DIV> </DIV></DIV></BLOCKQUOTE>
<DIV><FONT face="Courier New" size=2>The problem is here: PacketReceivePackets
returns when *at least* MinToCopy are available in the kernel buffer. If more
than mintocopy bytes are available, then all the available packets are copied in
the buffer passes to PacketReceivePackets.</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">-
ReadTimeout expires</DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">I
am just checking lpPacket->ulBytesReceived after every read and I found
that PacketReceivePacket() is returning bytes that ranges from 1k to more than
256k. </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">At
270mbps traffic, we can not expect ReadTimeout expiry. So only condition for
PacketReceivePacket() to return is 'MinToCopy bytes have been
copied'. But what I observed is only 1% of time it has returned 256k
rest 99% of attempts have returned values ranging from 1k to more than 256k
(2%). What I expect here is PacketReceivePacket() should return 256k in
most cases @270mbps traffic as per above conditions.</DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">And
NIC stats show that OID_GEN_RCV_NO_BUFFER is zero and winpcap stats also say
that no dropped frames.</DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Let
me know whether my understanding of PacketReceivePacket is wrong? or In what
conditions PacketReceivePacket() can return less than mintocopy bytes even
though there is no readtimeout expiry?</DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2>It can be due to buffering, but I don't have a
definitive answer to why you would receive less than mintocopy bytes. Why are
you so concerned of receiving exactly 256k with each call to
PacketReceivePackets? </FONT></DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2>Also, out of curiosity, why are you using the Packet
API instead of the pcap one?</FONT></DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2></FONT> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2>Have a nice day</FONT></DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"><FONT
face="Courier New" size=2>GV</FONT></DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Thanks
in advance for any help.</DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif"> </DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Regards,</DIV>
<DIV
style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">Shrinivas</DIV><BR><!--6-->
<HR SIZE=1>
</HR>Add more friends to your messenger and enjoy! <A
href="http://in.rd.yahoo.com/tagline_messenger_6/*http://messenger.yahoo.com/invite/">Invite
them now.</A>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>