<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<!--[if !mso]>
<style>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style>
<![endif]--><o:SmartTagType
namespaceuri="urn:schemas-microsoft-com:office:smarttags" name="PersonName"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="country-region"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PostalCode"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="State"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="address"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="Street"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:PMingLiU;
panose-1:2 1 6 1 0 1 1 1 1 1;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@PMingLiU";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:PMingLiU;}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle17
{mso-style-type:personal;
font-family:Arial;
color:navy;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:Arial;
color:navy;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>Thanks for jumping in and correcting my
misconception! I was following an earlier comment about that; I should have
checked that the information was correct.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>- Al -<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New Roman";color:navy'> </span></font><font
color=navy><span style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>----------------------------------------------------------------------------<br>
Alan Jay Weiner / Valid8.com, Inc. - Conform, Perform & Excel(tm)<br>
500 W Cummings Park, <st1:address w:st="on"><st1:Street w:st="on">Suite #</st1:Street>2700</st1:address>,
<st1:place w:st="on"><st1:City w:st="on">Woburn</st1:City>, <st1:State w:st="on">MA</st1:State>
<st1:PostalCode w:st="on">01801</st1:PostalCode>, <st1:country-region w:st="on">USA</st1:country-region></st1:place><br>
<a href="mailto:a.weiner@valid8.com">a.weiner@valid8.com</a> /
Tel:+1-781-938-1221 x112, Fax +1-781-207-0550<br>
<a href="http://www.VALID8.com">http://www.VALID8.com</a> </span></font><font
color=navy><span style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New Roman";color:navy'> </span></font><o:p></o:p></p>
</div>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt;font-family:"Times New Roman"'>
<hr size=2 width="100%" align=center tabindex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'>
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b><span
style='font-weight:bold'>On Behalf Of </span></b>Gianluca Varenni<br>
<b><span style='font-weight:bold'>Sent:</span></b> Tuesday, May 26, 2009 1:22
PM<br>
<b><span style='font-weight:bold'>To:</span></b> winpcap-users@winpcap.org<br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users] How
canigetthenew-estpacketfrombuffer?HELPPLEASE~!</span></font><font
face="Times New Roman"><span style='font-family:"Times New Roman"'><o:p></o:p></span></font></p>
</div>
<p class=MsoNormal><font size=3 face=PMingLiU><span style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt;font-family:"Times New Roman"'>Sorry for jumping in this conversation
late.</span></font><font face="Times New Roman"><span style='font-family:"Times New Roman"'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt;font-family:"Times New Roman"'>Please be aware that WinPcap does *not*
overwrite older packets with new ones. If the kernel buffer (or the user
buffer) is full, newer packets are simply dropped.</span></font><font
face="Times New Roman"><span style='font-family:"Times New Roman"'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> <o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt;font-family:"Times New Roman"'>Have a nice day</span></font><font
face="Times New Roman"><span style='font-family:"Times New Roman"'><o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=2 face="Times New Roman"><span style='font-size:
10.0pt;font-family:"Times New Roman"'>GV</span></font><font
face="Times New Roman"><span style='font-family:"Times New Roman"'><o:p></o:p></span></font></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0in 0in 0in 4.0pt;
margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>----- Original Message ----- <o:p></o:p></span></font></p>
</div>
<div style='font-color:black'>
<p class=MsoNormal style='background:#E4E4E4'><b><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial;font-weight:bold'>From:</span></font></b><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'> <a
href="mailto:a.weiner@valid8.com" title="a.weiner@valid8.com">Alan Jay Weiner</a>
<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>To:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> <a
href="mailto:winpcap-users@winpcap.org" title="winpcap-users@winpcap.org">winpcap-users@winpcap.org</a>
<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>Sent:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Tuesday, May 26, 2009
9:27 AM<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><b><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial;font-weight:bold'>Subject:</span></font></b><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'> Re:
[Winpcap-users] How can igetthenew-estpacketfrombuffer?HELPPLEASE~!<o:p></o:p></span></font></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'><o:p> </o:p></span></font></p>
</div>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>I presume the packets contain some kind of
status conditions and you’re doing something based on the latest status.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>What about using small buffers? The
older data is overwritten by newer data - if the buffer is only large enough
for 1 or 2 packets, you’ll get the 1 or 2 most-recent packets. All
the other packets will be lost, but that seems ok in your situation.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>How many of the most-recent packets do you
need? Is it sufficient to have only the most-recent packet?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>- Al Weiner -<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New Roman";color:navy'> </span></font><font
color=navy><span style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 color=navy face=Arial><span style='font-size:
10.0pt;font-family:Arial;color:navy'>----------------------------------------------------------------------------<br>
Alan Jay Weiner / Valid8.com, Inc. - Conform, Perform & Excel(tm)<br>
500 W Cummings Park, <st1:address w:st="on"><st1:Street w:st="on">Suite #</st1:Street>2700</st1:address>,
<st1:place w:st="on"><st1:City w:st="on">Woburn</st1:City>, <st1:State w:st="on">MA</st1:State>
<st1:PostalCode w:st="on">01801</st1:PostalCode>, <st1:country-region w:st="on">USA</st1:country-region></st1:place><br>
<a href="mailto:a.weiner@valid8.com">a.weiner@valid8.com</a> /
Tel:+1-781-938-1221 x112, Fax +1-781-207-0550<br>
<a href="http://www.VALID8.com">http://www.VALID8.com</a> </span></font><font
color=navy><span style='color:navy'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=navy face="Times New Roman"><span
style='font-size:12.0pt;font-family:"Times New Roman";color:navy'> </span></font><o:p></o:p></p>
</div>
<div>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face=PMingLiU><span style='font-size:12.0pt'>
<hr size=2 width="100%" align=center tabIndex=-1>
</span></font></div>
<p class=MsoNormal><b><font size=2 face=Tahoma><span style='font-size:10.0pt;
font-family:Tahoma;font-weight:bold'>From:</span></font></b><font size=2
face=Tahoma><span style='font-size:10.0pt;font-family:Tahoma'> winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] <b><span style='font-weight:bold'>On
Behalf Of </span></b>rst<br>
<b><span style='font-weight:bold'>Sent:</span></b> Tuesday, May 26, 2009 5:19
AM<br>
<b><span style='font-weight:bold'>To:</span></b> <st1:PersonName w:st="on">winpcap-users@winpcap.org</st1:PersonName><br>
<b><span style='font-weight:bold'>Subject:</span></b> Re: [Winpcap-users] How
can i getthenew-estpacketfrombuffer?HELPPLEASE~!</span></font><o:p></o:p></p>
</div>
<p class=MsoNormal><font size=3 face=PMingLiU><span style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>The
machine always sending packets , never stop.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>and
my computer only connected with the machine (using a crossover network cable).</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>so
every packets I get</span></font><font size=2 face="Times New Roman"><span
style='font-size:10.0pt;font-family:"Times New Roman"'> </span></font><font
size=2><span style='font-size:10.0pt'>are what I wanted, but only the newest
packet I need.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>Machine
----(Sending packets)---> My Computer</span></font><font size=2
face="Times New Roman"><span style='font-size:10.0pt;font-family:"Times New Roman"'> </span></font><font
size=2><span style='font-size:10.0pt'> .........................every 0.000005
second</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>My
Application ----(Get the newest packet)---> Get information to do
control...................every 0.0001 second</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>if
the buffer can contrain 10000 packets,</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>0.000005
* 10000 = 0.05 second,</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>so
I can only get the information before 0.05 second,</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>but
in my realtime control, i must get the information less than 0.0001 second.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>so
have any ideas?</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=PMingLiU><span style='font-size:10.0pt'>Really
thank you!!</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<blockquote style='border:none;border-left:solid black 1.5pt;padding:0in 0in 0in 4.0pt;
margin-left:3.75pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>If the other machine is sending a constant 200,000 packets
per second and won't slow down, you may be out of luck. However, if the
other machine sends 200,000 packet per second for a short burst (say 10
seconds), then you should be able to store those 2M packets into your own
memory space. After you store the packets, you can do your analysis.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>For a quick test, just change your control loop to do...</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>static int counter;</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>pcap_next_ex(...);</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>counter++;</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>That is, don't do anything with the packet (other than
advance the buffer and count how many you receive). This will tell you
how fast your machine can move through the buffer.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>If this works well, then you need to do a memcpy() of the
packet into pre-allocated space (i.e. malloc your own circular queue).
This will slow down the loop, but should be much faster than 0.1ms.</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Last question: Most packet capturing applications need
to decode EVERY packet, are you saying that you do NOT need to decode
every packet? If not, how do you know which packets you need to
decode and which ones you don't?</span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'> </span></font><o:p></o:p></p>
</div>
<div>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>DC</span></font><o:p></o:p></p>
</div>
</blockquote>
<div class=MsoNormal align=center style='text-align:center'><font size=3
face="Times New Roman"><span style='font-size:12.0pt;font-family:"Times New Roman"'>
<hr size=2 width="100%" align=center>
</span></font></div>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt;font-family:"Times New Roman"'>_______________________________________________<br>
Winpcap-users mailing list<br>
Winpcap-users@winpcap.org<br>
https://www.winpcap.org/mailman/listinfo/winpcap-users<o:p></o:p></span></font></p>
</blockquote>
</div>
</body>
</html>