<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.6000.16825" name=GENERATOR>
<STYLE>@font-face {
font-family: Tahoma;
}
@font-face {
font-family: Fixedsys;
}
@page Section1 {size: 8.5in 11.0in; margin: 1.0in 1.25in 1.0in 1.25in; }
P.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
LI.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
DIV.MsoNormal {
FONT-SIZE: 12pt; MARGIN: 0in 0in 0pt; FONT-FAMILY: "Times New Roman"
}
A:link {
COLOR: blue; TEXT-DECORATION: underline
}
SPAN.MsoHyperlink {
COLOR: blue; TEXT-DECORATION: underline
}
A:visited {
COLOR: purple; TEXT-DECORATION: underline
}
SPAN.MsoHyperlinkFollowed {
COLOR: purple; TEXT-DECORATION: underline
}
P {
FONT-SIZE: 12pt; MARGIN-LEFT: 0in; MARGIN-RIGHT: 0in; FONT-FAMILY: "Times New Roman"
}
SPAN.emailstyle17 {
COLOR: windowtext; FONT-FAMILY: Arial
}
SPAN.emailstyle20 {
COLOR: navy; FONT-FAMILY: Arial
}
SPAN.EmailStyle21 {
COLOR: navy; FONT-FAMILY: Arial
}
DIV.Section1 {
page: Section1
}
</STYLE>
</HEAD>
<BODY lang=EN-US vLink=purple link=blue bgColor=white>
<DIV><FONT size=2>The buffer is on an open-instance basis, not on a NIC basis.
So it's perfectly safe to have two threads setting different buffer sizes on the
same adapter, *provided* that you are using two different pcap_t handles.
</FONT></DIV>
<DIV><FONT size=2>Having said that, without a task manager screenshot it's
impossible to understand why it failed. The error basically means that a malloc
in the kernel driver failed, but it's impossible to know why without more
information about the memory load at the time of the failure...</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=Ed.Sassone@autonomy.com
href="mailto:Ed.Sassone@autonomy.com">Sassone, Ed</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, June 01, 2009 7:33 AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> Re: [Winpcap-users] pcap_setbuff
occasional failure</DIV>
<DIV><BR></DIV>
<DIV class=Section1>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">We finally caught the
error. We did not get the Task Manager screen shot. Also you are
correct in that serializing the initialization did not help.</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">One thing
interesting, we have two threads per NIC card setting different buffer sizes.
The first allocation worked and the second did not. The bracketed
number is the thread id.</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">05/29 14:24:54.53
Interface.cpp:93: [00001A54] Set buffer size to 1048576 for interface
\Device\NPF_{F4E3EFD7-CAB0-481B-86E3-874358548A34} : Signaling
Interface</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">05/29 14:24:54.53
Interface.cpp:85: [00001174] Could not set buffer size to 5242880 for
interface \Device\NPF_{F4E3EFD7-CAB0-481B-86E3-874358548A34}: driver error:
not enough memory to allocate the kernel buffer</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<DIV>
<P class=MsoNormal><STRONG><B><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Ed
Sassone</SPAN></FONT></B></STRONG></P>
<P class=MsoNormal><FONT face=Arial color=navy size=1><SPAN
style="FONT-SIZE: 7.5pt; COLOR: navy; FONT-FAMILY: Arial"><A
href="http://www.autonomy.com/">www.autonomy.com</A></SPAN></FONT></P>
<P class=MsoNormal><FONT face="Times New Roman" color=navy size=3><SPAN
style="FONT-SIZE: 12pt; COLOR: navy"></SPAN></FONT> </P>
<P class=MsoNormal><B><FONT face=Arial color=navy size=1><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 8pt; COLOR: navy; FONT-FAMILY: Arial">CONFIDENTIALITY
NOTICE: This communication and any files or attachments transmitted with it
contain information that is confidential to the sender and/or Autonomy, Inc.,
privileged or exempt from disclosure under applicable law. It is intended
solely for the use of the individual or the entity to which it is addressed.
If you are not the intended recipient(s), you are hereby notified that any
use, dissemination, or copying of this communication is strictly prohibited;
please do not read, copy, use or disclose the content of this communication to
others. If you have received this communication in error, please delete it and
contact our network administrator at (214) 981-3100. Thank
you.</SPAN></FONT></B></P></DIV>
<DIV>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">
<HR tabIndex=-1 align=center width="100%" SIZE=2>
</SPAN></FONT></DIV>
<P class=MsoNormal><B><FONT face=Tahoma size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">From:</SPAN></FONT></B><FONT
face=Tahoma size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org]
<B><SPAN style="FONT-WEIGHT: bold">On Behalf Of </SPAN></B>Sassone,
Ed<BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Wednesday, October
08, 2008 3:12 PM<BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B>
winpcap-users@winpcap.org<BR><B><SPAN
style="FONT-WEIGHT: bold">Subject:</SPAN></B> RE: [Winpcap-users] pcap_setbuff
occasional failure</SPAN></FONT></P></DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Essentially a
critical section around all the adapter initialization calls so it will only
be in one set a time, across all threads and adapters. Unfortunately I
didn’t have it print the pcap_geterr string. I just put that in.
It may be awhile until we catch it in the act.</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">thanks</SPAN></FONT></P>
<P class=MsoNormal><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial"></SPAN></FONT> </P>
<DIV>
<P class=MsoNormal><STRONG><B><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Ed
Sassone</SPAN></FONT></B></STRONG></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<P class=MsoNormal><B><FONT face=Tahoma size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">From:</SPAN></FONT></B><FONT
face=Tahoma size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Tahoma">
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org]
<B><SPAN style="FONT-WEIGHT: bold">On Behalf Of </SPAN></B>Gianluca
Varenni<BR><B><SPAN style="FONT-WEIGHT: bold">Sent:</SPAN></B> Wednesday,
October 08, 2008 2:05 PM<BR><B><SPAN style="FONT-WEIGHT: bold">To:</SPAN></B>
winpcap-users@winpcap.org<BR><B><SPAN
style="FONT-WEIGHT: bold">Subject:</SPAN></B> Re: [Winpcap-users] pcap_setbuff
occasional failure</SPAN></FONT></P></DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=2><SPAN
style="FONT-SIZE: 10pt">Serializing pcap_setbuff should not be necessary
(serializing against what? multiple calls on the same adapter? on the same
pcap_t handle?).</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=2><SPAN
style="FONT-SIZE: 10pt">Expecially considering that the only solution is a
reboot, I would think that there is some sort of leak either in the WinPcap
driver or in some other driver in the system. What's the exact error message
returned by pcap_setbuff?</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=2><SPAN
style="FONT-SIZE: 10pt">Also, after the problem occurs and before rebooting,
open Task Manager, go to the Performance Tab and send me a screenshot of it,
if possible.</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=2><SPAN
style="FONT-SIZE: 10pt">Have a nice day</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=2><SPAN
style="FONT-SIZE: 10pt">GV</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<BLOCKQUOTE
style="BORDER-RIGHT: medium none; PADDING-RIGHT: 0in; BORDER-TOP: medium none; PADDING-LEFT: 4pt; PADDING-BOTTOM: 0in; MARGIN: 5pt 0in 5pt 3.75pt; BORDER-LEFT: black 1.5pt solid; PADDING-TOP: 0in; BORDER-BOTTOM: medium none">
<DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">----- Original Message -----
</SPAN></FONT></P></DIV>
<DIV style="font-color: black">
<P class=MsoNormal style="BACKGROUND: #e4e4e4"><B><FONT face=Arial
size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Arial">From:</SPAN></FONT></B><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> <A
title=Ed.Sassone@autonomy.com href="mailto:Ed.Sassone@autonomy.com">Sassone,
Ed</A> </SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><B><FONT face=Arial size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Arial">To:</SPAN></FONT></B><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><B><FONT face=Arial size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Arial">Sent:</SPAN></FONT></B><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial"> Monday,
October 06, 2008 2:15 PM</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><B><FONT face=Arial size=2><SPAN
style="FONT-WEIGHT: bold; FONT-SIZE: 10pt; FONT-FAMILY: Arial">Subject:</SPAN></FONT></B><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">
[Winpcap-users] pcap_setbuff occasional failure</SPAN></FONT></P></DIV>
<DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P></DIV>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Hi</SPAN></FONT></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">Every so often in our
application during startup, the pcap</SPAN></FONT><FONT face=Fixedsys
size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Fixedsys">_</SPAN></FONT><FONT
face=Arial size=2><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">setbuff
call will fail. We are unable to re-create the problem but it seems to
happen after the application has been stopped and started a number of
times. Once the failure occurs it will continue to occur, until a
reboot. Our app is multithreaded with two threads starting per
interface card, and we can have more than one interface card
configured. The buffer size specified can vary but it’s usually around
5-10 MB. I have recently put in some changes to serialize the command
in case there is a timing issue, as I’m not sure if the call is thread
safe. I remember there was thread issue with the filter command.
This is on Windows 2003. Any other ideas? </SPAN></FONT></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<P class=MsoNormal><FONT face=Arial size=2><SPAN
style="FONT-SIZE: 10pt; FONT-FAMILY: Arial">thanks</SPAN></FONT></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<P class=MsoNormal><STRONG><B><FONT face=Arial color=navy size=2><SPAN
style="FONT-SIZE: 10pt; COLOR: navy; FONT-FAMILY: Arial">Ed
Sassone</SPAN></FONT></B></STRONG></P>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt"></SPAN></FONT> </P>
<DIV class=MsoNormal style="TEXT-ALIGN: center" align=center><FONT
face="Times New Roman" size=3><SPAN style="FONT-SIZE: 12pt">
<HR align=center width="100%" SIZE=2>
</SPAN></FONT></DIV>
<P class=MsoNormal><FONT face="Times New Roman" size=3><SPAN
style="FONT-SIZE: 12pt">_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users</SPAN></FONT></P></BLOCKQUOTE></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BODY></HTML>