<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1646936997;
mso-list-type:hybrid;
mso-list-template-ids:1931236606 67698703 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor=white lang=EN-US link=blue vlink=purple>
<div class=WordSection1>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'>There are other factors as well:<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>1.<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Number of processors and processor speed.<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>2.<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Amount of RAM<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>3.<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Operating system workload<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>4.<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Network Adapter Task Offloading capability (esp. checksum
offloading)<o:p></o:p></span></p>
<p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span
style='font-size:10.5pt;font-family:"Calibri","sans-serif";color:#1F497D'><span
style='mso-list:Ignore'>5.<span style='font:7.0pt "Times New Roman"'>
</span></span></span><![endif]><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'>Speed of disk subsystem<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'>On an modern fast quad-core system that is relatively idle (has
no other work to do) with lots of RAM and a high performance multi-disk RAID-0
array and with checksum offloading enabled in the adapter, it should be entirely
possible to capture a gigabit speed without packet loss.<o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'>If your system is an overtaxed (busy) single processor system
with only an average amount of RAM and an average speed non-RAID disk subsystem
however, then you’re very likely going to experience significant packet loss beyond
about 480 Mbps.<o:p></o:p></span></p>
<div>
<p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span
style='font-size:7.5pt;font-family:"Arial","sans-serif";color:black'>-- </span><span
style='color:#1F497D'><br>
</span><span style='font-size:13.5pt;font-family:"Arial","sans-serif";
color:black'> "</span><b><span style='font-family:"Arial","sans-serif";
color:green'>Fish</span></b><span style='font-size:13.5pt;font-family:"Arial","sans-serif";
color:black'>"</span><span style='font-size:10.0pt;font-family:"Arial","sans-serif";
color:black'> (</span><span style='font-size:10.0pt;font-family:"Comic Sans MS";
color:purple'>David B. Trout</span><span style='font-size:10.0pt;font-family:
"Arial","sans-serif";color:#1F497D'>)</span><span style='color:#1F497D'> <br>
</span><span style='font-size:10.0pt;font-family:"Verdana","sans-serif";
color:#1F497D'> </span><span style='color:#1F497D'> </span><u><span
style='font-size:10.0pt;font-family:"Arial","sans-serif";color:blue'>fish@softdevlabs.com</span></u><span
style='color:#1F497D'><o:p></o:p></span></p>
</div>
<p class=MsoNormal><span style='font-size:10.5pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'>
<div>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b>On
Behalf Of </b>yulou liu<br>
<b>Sent:</b> Sunday, September 19, 2010 12:50 AM<br>
<b>To:</b> winpcap-users@winpcap.org<br>
<b>Subject:</b> [Winpcap-users] About the packets loss , what is the bottleneck
?<br>
<b>Importance:</b> High<o:p></o:p></span></p>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'>There is still the question about packets loss.</span></span><span
style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'> </span></span><span class=apple-style-span><span
style='font-size:11.5pt'> </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'>According to the essay ' </span></span><span
class=apple-style-span><span style='font-size:10.0pt;font-family:"SimSun","serif"'>Profiling
and Optimization of Software-Based Network-Analysis Applications</span></span><span
class=apple-style-span><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>'
, every packet is copied twice in the main memory before
reaching the user. In order to reduce the cost of CPU and the bus
occupying of the SDRAM of pc, is it possible to copy data directly
from the kernel buffer to the final buffer , which I want the date
kept in ? </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'> </span></span><span class=apple-style-span><span
style='font-size:11.5pt'> </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'>Here is another idea --- </span></span><span
class=apple-style-span><span style='font-size:10.0pt;font-family:"SimSun","serif"'> allocate
several different user buffers , once </span></span><span
class=apple-style-span><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>a </span></span><span
class=apple-style-span><span style='font-size:10.0pt;font-family:"SimSun","serif"'>user
buffer is fulled , then let the next user buffer to save the </span></span><span
class=apple-style-span><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>new</span></span><span
class=apple-style-span><span style='font-size:10.0pt;font-family:"SimSun","serif"'> datas
from kernel buffer. Meanwhile copy datas from the first user buffer to
disk (assume that the hard disk write rate is fast enough).</span></span><span
class=apple-style-span><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>
Is this idea work with the winpcap ?</span></span><span class=apple-style-span><span
style='font-size:11.5pt'> </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'> </span></span><span class=apple-style-span><span
style='font-size:11.5pt'> </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'> </span></span><span class=apple-style-span><span
style='font-size:11.5pt'> </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'>Thank you!</span></span><span class=apple-style-span><span
style='font-size:11.5pt'> </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'> </span></span><span class=apple-style-span><span
style='font-size:11.5pt'> </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'>==============================================================</span></span><span
class=apple-style-span><span style='font-size:11.5pt'> </span></span><span
style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"Calibri","sans-serif"'> </span></span><span class=apple-style-span><span
style='font-size:11.5pt'> </span></span><span style='font-size:11.5pt'><br>
</span><span class=apple-style-span><span style='font-size:10.0pt;font-family:
"SimSun","serif"'>Q1: tough question to answer, as it depends on a number of
factors. What is the average packet size? Are you just counting the packets, or
dumping them to disk/DB/...? Do you see packet drops in the pcap_stats?</span></span><span
style='font-size:10.0pt;font-family:"SimSun","serif"'><br>
<span class=apple-style-span>Q2: I will need to run some tests on this. Do you
have some minimal sample code that shows the issue?</span><br>
<span class=apple-style-span>Q3: Yes, *if* the NIC (and NIC driver) are not
dropping packets themselves. </span><br>
<br>
<span class=apple-style-span>Did you disable any protocol bound to the NIC
where you receive all these packets?</span><br>
<br>
<span class=apple-style-span>Have a nice day</span><br>
<span class=apple-style-span>GV</span><br>
<br>
<br>
<br>
<br>
<span class=apple-style-span>From: yulou liu </span><br>
<span class=apple-style-span>Sent: Wednesday, August 25, 2010 11:08 AM</span><br>
<span class=apple-style-span>To: winpcap </span><br>
<span class=apple-style-span>Subject: [Winpcap-users] About the packets loss ,
what is the bottleneck ?</span><br>
<br>
<br>
<span class=apple-style-span>I'm using winpcap to capture datas from FPGA board
via 1G Ethernet connection(directly connected).</span><br>
<span class=apple-style-span>the FPGA is configed to send data at a special
rate. With the fpga sending rate increases,especially above 500Mbps, it
sometimes loss packets. </span><br>
<br>
<span class=apple-style-span>Q1: Is it possible to totally avoid packets
loss by optimism the code? I want to collect datas at speed 614Mbps
without packet loss (collecting all datas </span><br>
<br>
<span class=apple-style-span>last about 1 minutes). My workstations features
with 2 Xeon CPU (each has 4core), DDR3 SDRAM, 1 G onboard netcard.
Which part is the most probably bottleneck ?</span><br>
<br>
<span class=apple-style-span>Q2: As a test , I found the pcap_next_ex()
can't get any packets when the user buffer is set over 64 MB, what
does it happen ?</span><br>
<br>
<span class=apple-style-span>Q3: if the Kernel buffer's size is 16MB , then the
first 16Mb packets from fpga won't be lost, so , if I set the
kernel buffer as 128MB , then at least </span><br>
<br>
<span class=apple-style-span>the first coming 128MB data from FPGA won't be
lost either ? but I found When I set the kernel buffer bigger than 100
MB, the packets drops is getting </span><br>
<br>
<span class=apple-style-span>worse. </span><br>
<br>
<br>
<span class=apple-style-span>Thanks a lot!</span><br>
<br>
</span><span class=apple-style-span><span style='font-size:11.5pt'><o:p></o:p></span></span></p>
<pre><o:p> </o:p></pre></div>
</div>
</body>
</html>