<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML xmlns:v = "urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:m =
"http://schemas.microsoft.com/office/2004/12/omml"><HEAD>
<META content=text/html;charset=koi8-r http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16625"><BASE href="x-msg://1/">
<STYLE>
v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</STYLE>
<STYLE>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Geneva CY";}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.apple-style-span
{mso-style-name:apple-style-span;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.preprocessor
{mso-style-name:preprocessor;}
span.keywordtype
{mso-style-name:keywordtype;}
span.comment
{mso-style-name:comment;}
span.keywordflow
{mso-style-name:keywordflow;}
span.stringliteral
{mso-style-name:stringliteral;}
span.EmailStyle26
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle28
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
-->
</STYLE>
</HEAD>
<BODY
style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; WORD-WRAP: break-word; PADDING-TOP: 15px; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space"
id=MailContainerBody lang=EN-US leftMargin=0 link=blue topMargin=0 vLink=purple
CanvasTabStop="true" name="Compose message area">
<DIV><FONT face=Calibri>The WinPcap driver is not dispatched as a thread, at the
end of the story it's mainly interrupt driven.</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>Have a nice day</FONT></DIV>
<DIV><FONT face=Calibri>GV</FONT></DIV>
<DIV style="FONT: 10pt Tahoma">
<DIV><BR></DIV>
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A title=fish@infidels.org
href="mailto:fish@infidels.org">"Fish" (David B. Trout)</A> </DIV>
<DIV><B>Sent:</B> Monday, September 20, 2010 7:49 PM</DIV>
<DIV><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV><B>Subject:</B> Re: [Winpcap-users] WinPCAP packets capture
delay..</DIV></DIV></DIV>
<DIV><BR></DIV>
<DIV class=WordSection1>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">Yes,
you are correct. Adjusting “timeBeginPeriod” does not affect
QueryPerformanceCounter, but since it does affect task dispatching (apparently)
I thought setting it to a lower value might help to cause tasks (including the
WinPCap device diver (NPF.sys)) to be dispatched more quickly (i.e. with less
delay).<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">I
have no idea what delay/precision Alimjan is referring to.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 7.5pt">--
</SPAN><SPAN style="COLOR: #1f497d"><BR></SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 13.5pt">
"</SPAN><B><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: green">Fish</SPAN></B><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 13.5pt">"</SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 10pt">
(</SPAN><SPAN
style="FONT-FAMILY: 'Comic Sans MS'; COLOR: purple; FONT-SIZE: 10pt">David B.
Trout</SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10pt">)</SPAN><SPAN
style="COLOR: #1f497d"> <BR></SPAN><SPAN
style="FONT-FAMILY: 'Verdana','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10pt"> </SPAN><SPAN
style="COLOR: #1f497d"> </SPAN><U><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: blue; FONT-SIZE: 10pt">fish@softdevlabs.com</SPAN></U><SPAN
style="COLOR: #1f497d"><o:p></o:p></SPAN></P></DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: blue 1.5pt solid; PADDING-BOTTOM: 0in; PADDING-LEFT: 4pt; PADDING-RIGHT: 0in; BORDER-TOP: medium none; BORDER-RIGHT: medium none; PADDING-TOP: 0in">
<DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<P class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">From:</SPAN></B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org]
<B>On Behalf Of </B>Gianluca Varenni<BR><B>Sent:</B> Monday, September 20, 2010
4:49 PM<BR><B>To:</B> winpcap-users@winpcap.org<BR><B>Subject:</B> Re:
[Winpcap-users] WinPCAP packets capture delay..<BR><B>Importance:</B>
High<o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal><o:p> </o:p></P>
<DIV>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Calibri','sans-serif'">Timer
coalescing/timeBeginPeriod in practice change the scheduling quantum from
10-15ms (depending on the specific windows version) to around 1ms and does not
affect QueryPerformanceCounter (which is not based on that
timer).</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Calibri','sans-serif'">What is the
timestamp precision and delay that we are talking
about?</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN style="FONT-FAMILY: 'Calibri','sans-serif'">Have a nice
day</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'">GV</SPAN><o:p></o:p></P></DIV>
<DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt"><o:p> </o:p></SPAN></P></DIV>
<DIV>
<DIV>
<P style="BACKGROUND: whitesmoke" class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">From:</SPAN></B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt"> <A
title=fish@infidels.org href="mailto:fish@infidels.org">"Fish" (David B.
Trout)</A> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P style="BACKGROUND: whitesmoke" class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">Sent:</SPAN></B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt"> Sunday, September
19, 2010 5:06 PM<o:p></o:p></SPAN></P></DIV>
<DIV>
<P style="BACKGROUND: whitesmoke" class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">To:</SPAN></B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt"> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
<o:p></o:p></SPAN></P></DIV>
<DIV>
<P style="BACKGROUND: whitesmoke" class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">Subject:</SPAN></B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt"> Re: [Winpcap-users]
WinPCAP packets capture delay..<o:p></o:p></SPAN></P></DIV></DIV></DIV>
<DIV>
<P class=MsoNormal><o:p> </o:p></P></DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">You’re
welcome.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">As
to your problem there might not be anything you can do about it. Then again
however, there <I>might</I> be some things you can do to reduce the effect.
Things like using Windows 7 (with its Timer Coalescing feature) instead of
Windows XP. Disabling “SpeedStep” if your system supports it (so as to increase
the accuracy of QueryPerformanceCounter which is what WinPCap uses to timestamp
all its received packets with). You should also check to make sure you have the
latest BIOS version installed too.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">I
doubt it will help any (esp. if you’re using Windows 7 with its Timer
Coalescing feature), BUT... you might try using “timeBeginPeriod” and
“timeEndPeriod”, which I’ve heard sometimes increases the accuracy of Windows’s
timers.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">Finally,
many (if not all) of the issues listed in my post to yulou liu ("About the
packets loss, what is the bottleneck?") quite likely apply in your case too.
That is to say, if you’re doing using older single-processor hardware using an
older version of Windows, etc, then it’s hardly surprising that the timestamps
are inconsistent from one another. Windows can only do one thing at a time with
only one processor, and even with multiple processors there are bottlenecks
involved when you have unnecessary services running and/or unnecessary
applications running.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">If
you’re truly interested in obtaining the most accurate timings possible I would
use dedicated hardware specifically for that purpose (or at the very least a
real-time operating system and not a consumer level operating system like
Windows).<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">Describe
your hardware and operating environment again?<o:p></o:p></SPAN></P>
<DIV>
<P style="mso-margin-top-alt: auto; mso-margin-bottom-alt: auto"
class=MsoNormal><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 7.5pt">--
</SPAN><SPAN style="COLOR: #1f497d"><BR></SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 13.5pt">
"</SPAN><B><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: green">Fish</SPAN></B><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 13.5pt">"</SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 10pt">
(</SPAN><SPAN
style="FONT-FAMILY: 'Comic Sans MS'; COLOR: purple; FONT-SIZE: 10pt">David B.
Trout</SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10pt">)</SPAN><SPAN
style="COLOR: #1f497d"> <BR></SPAN><SPAN
style="FONT-FAMILY: 'Verdana','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10pt"> </SPAN><SPAN
style="COLOR: #1f497d"> </SPAN><U><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: blue; FONT-SIZE: 10pt">fish@softdevlabs.com</SPAN></U><SPAN
style="COLOR: #1f497d"><o:p></o:p></SPAN></P></DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"><o:p> </o:p></SPAN></P>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: blue 1.5pt solid; PADDING-BOTTOM: 0in; PADDING-LEFT: 4pt; PADDING-RIGHT: 0in; BORDER-TOP: medium none; BORDER-RIGHT: medium none; PADDING-TOP: 0in">
<DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<P class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">From:</SPAN></B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org]
<B>On Behalf Of </B>Alimjan Kuramshin<BR><B>Sent:</B> Sunday, September 19, 2010
5:46 AM<BR><B>To:</B> winpcap-users@winpcap.org<BR><B>Subject:</B> Re:
[Winpcap-users] WinPCAP packets capture delay..<BR><B>Importance:</B>
High<o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal><o:p> </o:p></P>
<DIV>
<P class=MsoNormal><o:p> </o:p></P></DIV>
<DIV>
<P class=MsoNormal>Hi, Devid! Maaany thanks for Your reply. NO, it's just an
example MAC's, actually i'm using hardware MAC's. And one more thing, my PC
(laptop) connected directly to the other PC (or custom device, it doesn't
mater i guess).. <o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal>Many thanks for Your attention, i've spend about 6-8 month
with this problem, and still no luck :(<o:p></o:p></P></DIV>
<P class=MsoNormal><o:p> </o:p></P>
<DIV>
<DIV>
<P class=MsoNormal>19.09.2010, Χ 15:25, Fish (David B. Trout)
ΞΑΠΙΣΑΜ(Α):<o:p></o:p></P></DIV>
<P style="MARGIN-BOTTOM: 12pt" class=MsoNormal><o:p> </o:p></P>
<DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">FYI:
be careful with the MAC address you choose.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"> </SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">Any
MAC address with the<SPAN
class=apple-converted-space> </SPAN><U>0x01</U><SPAN
class=apple-converted-space> </SPAN>bit on in the<SPAN
class=apple-converted-space> </SPAN><U>first byte</U><SPAN
class=apple-converted-space> </SPAN>is considered an<SPAN
class=apple-converted-space> </SPAN><I><U>all-stations</U></I><SPAN
class=apple-converted-space><U> </U></SPAN><I><U>broadcast</U>.</I></SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"> </SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">Is
that what you actually intended to do? Send 10,000 packets to ALL/every
network adapter on your local network?? (if your host has more than one
network adapter on the same physical network segment then they’ll<SPAN
class=apple-converted-space> </SPAN><I>both</I><SPAN
class=apple-converted-space> </SPAN>receive every
packet.)</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"> </SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">If
you need a MAC address to test with, the IANNA has reserved the range
00-00-5E-00-00-00 through 00-00-5E-FF-FF-FF just for that
purpose.</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"> </SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt">See
the section “IANA ETHERNET ADDRESS BLOCK - UNICAST USE” (about 0.75 of the way
down the web page) in the following document:</SPAN><o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"> </SPAN><o:p></o:p></P></DIV>
<DIV>
<P style="TEXT-INDENT: 0.5in" class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"> <A
href="http://www.iana.org/assignments/ethernet-numbers">http://www.iana.org/assignments/ethernet-numbers</A></SPAN><o:p></o:p></P></DIV>
<DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 7.5pt">--<SPAN
class=apple-converted-space> </SPAN></SPAN><SPAN
style="COLOR: #1f497d"><BR></SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 13.5pt">
"</SPAN><B><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: green">Fish</SPAN></B><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 13.5pt">"</SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: black; FONT-SIZE: 10pt">
(</SPAN><SPAN
style="FONT-FAMILY: 'Comic Sans MS'; COLOR: purple; FONT-SIZE: 10pt">David B.
Trout</SPAN><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10pt">)</SPAN><SPAN
class=apple-converted-space><SPAN
style="COLOR: #1f497d"> </SPAN></SPAN><SPAN
style="COLOR: #1f497d"><BR></SPAN><SPAN
style="FONT-FAMILY: 'Verdana','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10pt"> </SPAN><SPAN
style="COLOR: #1f497d"> <SPAN
class=apple-converted-space> </SPAN></SPAN><U><SPAN
style="FONT-FAMILY: 'Arial','sans-serif'; COLOR: blue; FONT-SIZE: 10pt"><A
href="mailto:fish@softdevlabs.com">fish@softdevlabs.com</A></SPAN></U><o:p></o:p></P></DIV></DIV>
<DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Calibri','sans-serif'; COLOR: #1f497d; FONT-SIZE: 10.5pt"> </SPAN><o:p></o:p></P></DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: blue 1.5pt solid; PADDING-BOTTOM: 0in; PADDING-LEFT: 4pt; PADDING-RIGHT: 0in; BORDER-TOP: medium none; BORDER-RIGHT: medium none; PADDING-TOP: 0in">
<DIV>
<DIV
style="BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<DIV>
<P class=MsoNormal><B><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt">From:</SPAN></B><SPAN
class=apple-converted-space><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt"> </SPAN></SPAN><SPAN
style="FONT-FAMILY: 'Tahoma','sans-serif'; FONT-SIZE: 10pt"><A
href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</A><SPAN
class=apple-converted-space> </SPAN>[mailto:winpcap-users-bounces@winpcap.org]<SPAN
class=apple-converted-space> </SPAN><B>On Behalf Of<SPAN
class=apple-converted-space> </SPAN></B>Alimjan
Kuramshin<BR><B>Sent:</B><SPAN
class=apple-converted-space> </SPAN>Saturday, September 18, 2010 2:33
PM<BR><B>To:</B><SPAN class=apple-converted-space> </SPAN><A
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A><BR><B>Subject:</B><SPAN
class=apple-converted-space> </SPAN>[Winpcap-users] WinPCAP packets capture
delay..<BR><B>Importance:</B><SPAN
class=apple-converted-space> </SPAN>High</SPAN><o:p></o:p></P></DIV></DIV></DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV>
<DIV>
<P class=MsoNormal>Hello!<o:p></o:p></P></DIV>
<DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV></DIV>
<DIV>
<DIV>
<P class=MsoNormal>Gianluca, can u run this code on Your machine and running the
Wireshark save the log and send it to me, please..<o:p></o:p></P></DIV></DIV>
<DIV>
<DIV>
<P class=MsoNormal>Is there any delays, i mean delays between the packets that
Wireshark (winpcap) capture?<o:p></o:p></P></DIV></DIV>
<DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV></DIV>
<DIV>
<DIV>
<P class=MsoNormal>P.S. code from WinPcap documentation, sending packets, not
one, but 10000 (or 1000000)..<o:p></o:p></P></DIV></DIV>
<DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV></DIV>
<DIV><PRE><SPAN class=preprocessor>#include <stdlib.h></SPAN><o:p></o:p></PRE><PRE><SPAN class=preprocessor>#include <stdio.h></SPAN><o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE><SPAN class=preprocessor>#include <pcap.h></SPAN><o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE><SPAN class=keywordtype>void</SPAN> main(<SPAN class=keywordtype>int</SPAN> argc, <SPAN class=keywordtype>char</SPAN> **argv)<o:p></o:p></PRE><PRE>{<o:p></o:p></PRE><PRE><A title="Descriptor of an open capture instance. This structure is opaque to the user, that..." href="http://www.winpcap.org/docs/docs_412/html/group__wpcap__def.html#ga4711d025f83503ce692efa5e45ec60a7">pcap_t</A> *fp;<o:p></o:p></PRE><PRE><SPAN class=keywordtype>char</SPAN> errbuf[<A title="Size to use when allocating the buffer that contains the libpcap errors." href="http://www.winpcap.org/docs/docs_412/html/group__wpcap__def.html#gacd448353957d92c98fccc29e1fc8d927">PCAP_ERRBUF_SIZE</A>];<o:p></o:p></PRE><PRE>u_char packet[100];<o:p></o:p></PRE><PRE><SPAN class=keywordtype>int</SPAN> i;<o:p></o:p></PRE><PRE>volatile int n_pkts = 10000; // 1000000<o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE> <SPAN class=comment>/* Check the validity of the command line */</SPAN><o:p></o:p></PRE><PRE> <SPAN class=keywordflow>if</SPAN> (argc != 2)<o:p></o:p></PRE><PRE> {<o:p></o:p></PRE><PRE> printf(<SPAN class=stringliteral>"usage: %s interface (e.g. 'rpcap://eth0')"</SPAN>, argv[0]);<o:p></o:p></PRE><PRE> <SPAN class=keywordflow>return</SPAN>;<o:p></o:p></PRE><PRE> }<o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE> <SPAN class=comment>/* Open the output device */</SPAN><o:p></o:p></PRE><PRE> <SPAN class=keywordflow>if</SPAN> ( (fp= <A title="Open a generic source in order to capture / send (WinPcap only) traffic." href="http://www.winpcap.org/docs/docs_412/html/group__wpcapfunc.html#ga2b64c7b6490090d1d37088794f1f1791">pcap_open</A>(argv[1], <SPAN class=comment>// name of the device</SPAN><o:p></o:p></PRE><PRE> 65536, <SPAN class=comment>// portion of the packet to capture (only the first 100 bytes)</SPAN><o:p></o:p></PRE><PRE> <A title="Defines if the adapter has to go in promiscuous mode." href="http://www.winpcap.org/docs/docs_412/html/group__remote__open__flags.html#ga9134ce51a9a6a7d497c3dee5affdc3b9">PCAP_OPENFLAG_PROMISCUOUS</A>, <SPAN class=comment>// promiscuous mode</SPAN><o:p></o:p></PRE><PRE> 1000, <SPAN class=comment>// read timeout</SPAN><o:p></o:p></PRE><PRE> NULL, <SPAN class=comment>// authentication on the remote machine</SPAN><o:p></o:p></PRE><PRE> errbuf <SPAN class=comment>// error buffer</SPAN><o:p></o:p></PRE><PRE> ) ) == NULL)<o:p></o:p></PRE><PRE> {<o:p></o:p></PRE><PRE> fprintf(stderr,<SPAN class=stringliteral>"\nUnable to open the adapter. %s is not supported by WinPcap\n"</SPAN>, argv[1]);<o:p></o:p></PRE><PRE> <SPAN class=keywordflow>return</SPAN>;<o:p></o:p></PRE><PRE> }<o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE> <SPAN class=comment>/* Supposing to be on ethernet, set mac destination to 1:1:1:1:1:1 */</SPAN><o:p></o:p></PRE><PRE> packet[0]=1;<o:p></o:p></PRE><PRE> packet[1]=1;<o:p></o:p></PRE><PRE> packet[2]=1;<o:p></o:p></PRE><PRE> packet[3]=1;<o:p></o:p></PRE><PRE> packet[4]=1;<o:p></o:p></PRE><PRE> packet[5]=1;<o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE> <SPAN class=comment>/* set mac source to 2:2:2:2:2:2 */</SPAN><o:p></o:p></PRE><PRE> packet[6]=2;<o:p></o:p></PRE><PRE> packet[7]=2;<o:p></o:p></PRE><PRE> packet[8]=2;<o:p></o:p></PRE><PRE> packet[9]=2;<o:p></o:p></PRE><PRE> packet[10]=2;<o:p></o:p></PRE><PRE> packet[11]=2;<o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE> <SPAN class=comment>/* Fill the rest of the packet */</SPAN><o:p></o:p></PRE><PRE> <SPAN class=keywordflow>for</SPAN>(i=12;i<100;i++)<o:p></o:p></PRE><PRE> {<o:p></o:p></PRE><PRE> packet[i]=(u_char)i;<o:p></o:p></PRE><PRE> }<o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE> while (n_pkts--)<o:p></o:p></PRE><PRE> <SPAN class=comment>/* Send down the packet */</SPAN><o:p></o:p></PRE><PRE> <SPAN class=keywordflow>if</SPAN> (<A title="Send a raw packet." href="http://www.winpcap.org/docs/docs_412/html/group__wpcapfunc.html#ga51dbda0f1ab9da2cfe49d657486d50b2">pcap_sendpacket</A>(fp, packet, 100 <SPAN class=comment>/* size */</SPAN>) != 0)<o:p></o:p></PRE><PRE> {<o:p></o:p></PRE><PRE> fprintf(stderr,<SPAN class=stringliteral>"\nError sending the packet: %s\n"</SPAN>, <A title="return the error text pertaining to the last pcap library error." href="http://www.winpcap.org/docs/docs_412/html/group__wpcapfunc.html#ga81305cb154e4497e95bbb9b708631a3a">pcap_geterr</A>(fp));<o:p></o:p></PRE><PRE> <SPAN class=keywordflow>return</SPAN>;<o:p></o:p></PRE><PRE> }<o:p></o:p></PRE><PRE> <o:p></o:p></PRE><PRE> <SPAN class=keywordflow>return</SPAN>;<o:p></o:p></PRE><PRE>}<o:p></o:p></PRE><PRE>/* EOF */<o:p></o:p></PRE><PRE>Thanks, bye..<o:p></o:p></PRE><PRE> <o:p></o:p></PRE>
<DIV>
<DIV>
<P class=MsoNormal> <o:p></o:p></P></DIV></DIV></DIV></DIV>
<P class=MsoNormal><SPAN
style="FONT-FAMILY: 'Geneva CY'; FONT-SIZE: 13.5pt">_______________________________________________<BR>Winpcap-users
mailing list<BR><A
href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</A><BR><A
href="https://www.winpcap.org/mailman/listinfo/winpcap-users">https://www.winpcap.org/mailman/listinfo/winpcap-users</A><o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal><o:p> </o:p></P></DIV>
<DIV style="TEXT-ALIGN: center" class=MsoNormal align=center>
<HR align=center SIZE=2 width="100%">
</DIV>
<P
class=MsoNormal>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<o:p></o:p></P></DIV></DIV>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BODY></HTML>