<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=text/html;charset=gb2312 http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7600.16625"></HEAD>
<BODY style="PADDING-LEFT: 10px; PADDING-RIGHT: 10px; PADDING-TOP: 15px"
id=MailContainerBody leftMargin=0 topMargin=0 CanvasTabStop="true"
name="Compose message area">
<DIV> <FONT face=Calibri>1) not at the moment.</FONT></DIV>
<DIV><FONT face=Calibri>2) not at the moment.</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>As I said, if the problem is the number of copies, you
would see the dropped packet count different from zero. </FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>Did you try with another network card not integrated on
the MoBo? What is the network card on your motherboard?</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV><FONT face=Calibri>Have a nice day</FONT></DIV>
<DIV><FONT face=Calibri>GV</FONT></DIV>
<DIV><FONT face=Calibri></FONT> </DIV>
<DIV style="FONT: 10pt Tahoma">
<DIV><FONT size=3 face=Calibri></FONT><BR></DIV>
<DIV style="BACKGROUND: #f5f5f5">
<DIV style="font-color: black"><B>From:</B> <A title=liu.yulou@zte.com.cn
href="mailto:liu.yulou@zte.com.cn">liu.yulou@zte.com.cn</A> </DIV>
<DIV><B>Sent:</B> Wednesday, September 29, 2010 5:42 PM</DIV>
<DIV><B>To:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> </DIV>
<DIV><B>Cc:</B> <A title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A> ; <A
title=winpcap-users-bounces@winpcap.org
href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</A>
</DIV>
<DIV><B>Subject:</B> [Winpcap-users] 答复: Re: About the packets loss , what is
the bottleneck ?</DIV></DIV></DIV>
<DIV><BR></DIV><BR><FONT size=2 face=sans-serif>thank you for the answer. there
are two questions :</FONT> <BR><BR><FONT size=2 face=sans-serif>1. </FONT><FONT
size=2 face=Calibri> is it possible to copy data directly from the kernel
buffer to the final buffer ( which I want the date kept in) ?
</FONT><BR><FONT size=2 face=sans-serif>2. or is there any way that programmer
can modify the address of the user buffer directly? </FONT><BR><BR><FONT size=2
face=sans-serif>thank you.</FONT> <BR><FONT size=2
face=sans-serif><BR></FONT><BR><BR><FONT size=2 face=sans-serif>Yulou</FONT>
<BR><BR><BR><BR><BR>
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD width="35%"><FONT size=1 face=sans-serif><B>"Gianluca Varenni" <<A
href="mailto:gianluca.varenni@cacetech.com">gianluca.varenni@cacetech.com</A>></B>
</FONT><BR><FONT size=1 face=sans-serif>发件人: <A
href="mailto:winpcap-users-bounces@winpcap.org">winpcap-users-bounces@winpcap.org</A></FONT>
<P><FONT size=1 face=sans-serif>2010-09-21 07:45</FONT>
<TABLE border=1>
<TBODY>
<TR vAlign=top>
<TD bgColor=white>
<DIV align=center><FONT size=1 face=sans-serif>请答复 给<BR><A
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A></FONT></DIV></TD></TR></TBODY></TABLE><BR></P>
<TD width="64%">
<TABLE width="100%">
<TBODY>
<TR vAlign=top>
<TD>
<DIV align=right><FONT size=1 face=sans-serif>收件人</FONT></DIV>
<TD><FONT size=1 face=sans-serif><<A
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>></FONT>
<TR vAlign=top>
<TD>
<DIV align=right><FONT size=1 face=sans-serif>抄送</FONT></DIV>
<TD>
<TR vAlign=top>
<TD>
<DIV align=right><FONT size=1 face=sans-serif>主题</FONT></DIV>
<TD><FONT size=1 face=sans-serif>Re: [Winpcap-users] About the
packets loss , what is the bottleneck
?</FONT></TD></TR></TBODY></TABLE><BR>
<TABLE>
<TBODY>
<TR vAlign=top>
<TD>
<TD></TD></TR></TBODY></TABLE><BR></TD></TR></TBODY></TABLE><BR><BR><BR><FONT
size=3 face=Calibri>Two notes: </FONT><BR><FONT size=3> </FONT> <BR><FONT
size=3 face=Calibri>1. if the objective is dumping the packets to disk, then the
bottleneck is mostly the disk. </FONT><BR><FONT size=3 face=Calibri>2. checksum
offloading does not play any role in packet capture. It plays a role when
packets have to be processed by the TCP/IP stack (because the validation is done
in hardware rather software). But when you do packet capture, you don't care
about that. In fact I suggested to totally disable TCP/IP from the NIC where you
capture the packets from.</FONT> <BR><FONT size=3> </FONT> <BR><FONT size=3
face=Calibri>GV</FONT> <BR><BR><FONT size=3><B>From:</B> </FONT><A
href="mailto:fish@infidels.org"><FONT color=blue size=3><U>"Fish" (David B.
Trout)</U></FONT></A><FONT size=3> </FONT><BR><FONT size=3><B>Sent:</B> Sunday,
September 19, 2010 4:44 AM</FONT> <BR><FONT size=3><B>To:</B> </FONT><A
href="mailto:winpcap-users@winpcap.org"><FONT color=blue
size=3><U>winpcap-users@winpcap.org</U></FONT></A><FONT size=3> </FONT><BR><FONT
size=3><B>Subject:</B> Re: [Winpcap-users] About the packets loss ,what is the
bottleneck ?</FONT> <BR><BR><FONT color=#1f497d size=2 face=Calibri>There are
other factors as well:</FONT> <BR><FONT color=#1f497d size=2
face=Calibri> </FONT> <BR><FONT color=#1f497d size=2 face=Calibri>1.
Number of processors and processor speed.</FONT> <BR><FONT
color=#1f497d size=2 face=Calibri>2. Amount of RAM</FONT>
<BR><FONT color=#1f497d size=2 face=Calibri>3. Operating
system workload</FONT> <BR><FONT color=#1f497d size=2 face=Calibri>4.
Network Adapter Task Offloading capability (esp. checksum
offloading)</FONT> <BR><FONT color=#1f497d size=2 face=Calibri>5.
Speed of disk subsystem</FONT> <BR><FONT color=#1f497d size=2
face=Calibri> </FONT> <BR><FONT color=#1f497d size=2 face=Calibri>On an
modern fast quad-core system that is relatively idle (has no other work to do)
with lots of RAM and a high performance multi-disk RAID-0 array and with
checksum offloading enabled in the adapter, it should be entirely possible to
capture a gigabit speed without packet loss.</FONT> <BR><FONT color=#1f497d
size=2 face=Calibri> </FONT> <BR><FONT color=#1f497d size=2 face=Calibri>If
your system is an overtaxed (busy) single processor system with only an average
amount of RAM and an average speed non-RAID disk subsystem however, then you’re
very likely going to experience significant packet loss beyond about 480
Mbps.</FONT> <BR><FONT size=1 face=Arial>-- </FONT><FONT size=4
face=Arial><BR> "</FONT><FONT color=#008000 size=3
face=Arial><B>Fish</B></FONT><FONT size=4 face=Arial>"</FONT><FONT size=2
face=Arial> (</FONT><FONT color=#800080 size=2 face="Comic Sans MS">David
B. Trout</FONT><FONT color=#1f497d size=2 face=Arial>)</FONT><FONT color=#1f497d
size=3 face="Times New Roman"> </FONT><FONT color=#1f497d size=2
face=Verdana><BR> </FONT><FONT color=#1f497d size=3 face="Times New Roman">
</FONT><FONT color=blue size=2
face=Arial><U>fish@softdevlabs.com</U></FONT> <BR><FONT color=#1f497d size=2
face=Calibri> </FONT> <BR><FONT size=2 face=Tahoma><B>From:</B>
winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org]
<B>On Behalf Of </B>yulou liu<B><BR>Sent:</B> Sunday, September 19, 2010 12:50
AM<B><BR>To:</B> winpcap-users@winpcap.org<B><BR>Subject:</B> [Winpcap-users]
About the packets loss , what is the bottleneck ?<B><BR>Importance:</B>
High</FONT> <BR><FONT size=3 face="Times New Roman"> </FONT> <BR><FONT
size=2 face=Calibri><BR>There is still the question about packets
loss.<BR></FONT><FONT size=3 face="Times New Roman"> </FONT><FONT size=2
face=Calibri><BR>According to the essay ' </FONT><FONT size=2>Profiling
and Optimization of Software-Based Network-Analysis Applications</FONT><FONT
size=2 face=Calibri>' , every packet is copied twice in the main
memory before reaching the user. In order to reduce the cost of CPU and
the bus occupying of the SDRAM of pc, is it possible to copy data
directly from the kernel buffer to the final buffer , which I want the
date kept in ? <BR></FONT><FONT size=3
face="Times New Roman"> </FONT><FONT size=2 face=Calibri><BR>Here is
another idea --- </FONT><FONT size=2> allocate several different user
buffers , once </FONT><FONT size=2 face=Calibri>a </FONT><FONT size=2>user
buffer is fulled , then let the next user buffer to save the </FONT><FONT size=2
face=Calibri>new</FONT><FONT size=2> datas from kernel buffer. Meanwhile
copy datas from the first user buffer to disk (assume that the hard disk write
rate is fast enough).</FONT><FONT size=2 face=Calibri> Is this idea work
with the winpcap ?</FONT><FONT size=3 face="Times New Roman"> </FONT><FONT
size=2 face=Calibri><BR></FONT><FONT size=3
face="Times New Roman"> </FONT><FONT size=2 face=Calibri><BR></FONT><FONT
size=3 face="Times New Roman"> </FONT><FONT size=2 face=Calibri><BR>Thank
you!</FONT><FONT size=3 face="Times New Roman"> </FONT><FONT size=2
face=Calibri><BR></FONT><FONT size=3 face="Times New Roman"> </FONT><FONT
size=2
face=Calibri><BR>==============================================================</FONT><FONT
size=3 face="Times New Roman"> </FONT><FONT size=2 face=Calibri><BR></FONT><FONT
size=3 face="Times New Roman"> </FONT><FONT size=2><BR>Q1: tough question
to answer, as it depends on a number of factors. What is the average packet
size? Are you just counting the packets, or dumping them to disk/DB/...? Do you
see packet drops in the pcap_stats?<BR>Q2: I will need to run some tests on
this. Do you have some minimal sample code that shows the issue?<BR>Q3: Yes,
*if* the NIC (and NIC driver) are not dropping packets themselves. <BR><BR>Did
you disable any protocol bound to the NIC where you receive all these
packets?<BR><BR>Have a nice day<BR>GV<BR><BR><BR><BR><BR>From: yulou liu
<BR>Sent: Wednesday, August 25, 2010 11:08 AM<BR>To: winpcap <BR>Subject:
[Winpcap-users] About the packets loss , what is the bottleneck ?<BR><BR><BR>I'm
using winpcap to capture datas from FPGA board via 1G Ethernet
connection(directly connected).<BR>the FPGA is configed to send data at a
special rate. With the fpga sending rate increases,especially above
500Mbps, it sometimes loss packets. <BR><BR>Q1: Is it possible to totally
avoid packets loss by optimism the code? I want to collect datas at speed
614Mbps without packet loss (collecting all datas <BR><BR>last about 1 minutes).
My workstations features with 2 Xeon CPU (each has 4core), DDR3 SDRAM, 1 G
onboard netcard. Which part is the most probably bottleneck
?<BR><BR>Q2: As a test , I found the pcap_next_ex() can't get any packets
when the user buffer is set over 64 MB, what does it happen
?<BR><BR>Q3: if the Kernel buffer's size is 16MB , then the first 16Mb packets
from fpga won't be lost, so , if I set the kernel buffer as 128MB ,
then at least <BR><BR>the first coming 128MB data from FPGA won't be lost
either ? but I found When I set the kernel buffer bigger than 100 MB, the
packets drops is getting <BR><BR>worse. <BR><BR><BR>Thanks a
lot!<BR></FONT><BR><FONT size=2 face="Courier New"> </FONT>
<P>
<HR>
<P><FONT size=3>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users</FONT><FONT
size=2><TT>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></TT></FONT>
<P><BR><PRE>--------------------------------------------------------
ZTE Information Security Notice: The information contained in this mail is solely property of the sender's organization. This mail communication is confidential. Recipients named above are obligated to maintain secrecy and are not permitted to disclose the contents of this communication to others.
This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the originator of the message. Any views expressed in this message are those of the individual sender.
This message has been scanned for viruses and Spam by ZTE Anti-Spam system.
</PRE>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BODY></HTML>