<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hi,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>My machine windows XP (win32) gets the voice traffic of more
than 250 Mbps at NIC from a switch. Basically, my NIC was at 100 Mbps and the
port on the switch is also the same. I am developing an app to use winpcap lib
to read packets from my NIC and write it to file. I also ran parallel wireshark
to check performance of my app. When my app and wireshark running both at a
time on my machine, I could clearly see that the packets were getting lost.
This was at the time when the traffic was 100 Mbps. When my app was trying to
read 100 Mbps packets rate I could clearly see that not all the packets were
read and most of the packets were lost by my app but in wireshark I could see all
the packets in sequence, thought the limit of 100 Mbps is reached, I increased
the link to be 1Gig at switch port and my NIC. Now the 100 Mbps is ok. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I increased the load to receive 150 Mbps, which almost was
very equal to the wireshark capturing, was fine there. When I jumped to 200
Mbps and (max) 250 Mbps traffic. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Here I again encountered the packets are getting lost. Now
this time when I compared with wireshark, there I could see clearly that it did
not had some of the sequence packets and it did not mention or say that the
packet segmentation lost. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Might be that the packets are genuinely lost at the switch or
the winpcap library kernel buffer is getting overflown at this limit. At the
switch the port is 1Gig bit, seems like no issue from the switch port. Found
that the winpcap has limit of 128 MB kernel buffer size in the 32 bit. I ran
the same in the 64 bit machine, got the same issue there also. But its limit
there seems to be 128 GB. Not sure whether these values are correct or not. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>My next alternate is to try increasing the winpcap kernel
buffer size for 32 bit. I don’t want to try new things with 64 bit
machine. I saw some thread to use <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>BOOLEAN PacketSetBuff(LPADAPTER AdapterObject, int dim)
function.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>But where I can I find complete details of where can I find
this function in which file of Winpcap file and details of the library name,
file name, dll name. FYI, my app uses v4.0.2 winpcap. A quick response with
some helpful stuff is appreciable.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thanks,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> SIPSantosh.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'> <o:p></o:p></span></font></p>
</div>
</body>
</html>