<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Hi everyone,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This is a follow up question to an old post (Dec of 2008).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>*<b>BEGIN OLD POST</b>*<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><pre>><i> On Wed, Dec 10, 2008 at 12:30 PM, Gianluca Varenni<o:p></o:p></i></pre><pre>><i> <<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users">gianluca.varenni at cacetech.com</a>> wrote:<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>><i> ----- Original Message ----- From: "Victor Ginzburg" <o:p></o:p></i></pre><pre>>><i> <<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users">vginzburg at gmail.com</a>><o:p></o:p></i></pre><pre>>><i> To: <<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users">winpcap-users at winpcap.org</a>><o:p></o:p></i></pre><pre>>><i> Sent: Monday, December 08, 2008 11:25 AM<o:p></o:p></i></pre><pre>>><i> Subject: [Winpcap-users] pcap_next_ex<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>>><i> Hi All,<o:p></o:p></i></pre><pre>>>><i><o:p> </o:p></i></pre><pre>>>><i> Is there any way to pick-up multiple packets with one call rather than<o:p></o:p></i></pre><pre>>>><i> one packet at a time with pcap_next_ex?<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>><i> No, at the moment there's no API for that.<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>>><i> And if yes, is there big<o:p></o:p></i></pre><pre>>>><i> performance improvement in terms using less CPU?<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>><i> The performance improvement would be minimal. What is the packet rate <o:p></o:p></i></pre><pre>>><i> that<o:p></o:p></i></pre><pre>>><i> we are talking about?<o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> around 2000 per second<o:p></o:p></i></pre><pre><o:p> </o:p></pre><pre>At 2k packets per second forget about any performance improvement receiving <o:p></o:p></pre><pre>multiple packets within one call. If you have any performance problems, they <o:p></o:p></pre><pre>are definitely not due to the calls to pcap_next_ex returning one packet at <o:p></o:p></pre><pre>a time.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Have a nice day<o:p></o:p></pre><pre>GV<o:p></o:p></pre><pre><o:p> </o:p></pre><p class=MsoNormal>*<b>END OLD POST</b>*<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Question 1) I have an application that will need to retrieve 50k packets/second (all UDP, all ~200 bytes, coming from a range of ports, for which I will use a filter). Will using pcap_next_ex() in this case cause a performance hit? IE Does it have to transition to kernel mode for getting each packet? Or has it pulled a buffer from the kernel such that it's just reading the copied buffer until it is exhausted? Then subsequently reading the kernel buffer again? If it has to transition to kernel mode what is the cost for making 50000 transitions in per second?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Question 2) Is there now or is there planned a way to read all the packets that are available in one call so that I can process all of them from a single call to pcap_next_ex() or some similar function?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Question 3) If the answer to #2 is no, and the call to pcap_next_ex() only calls into the kernel periodically to retrieve the buffer and as long as my thread can keep up with processing the buffer, then I would assume that I would have no packet loss from the kernel buffer. Is this a correct assumption?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Question 4) Is it possible/worthwhile to setup multiple threads to each have a filter that is a subset of the entire range of ports that need to be captured such that I can divvy up the work on a multiple core machine with each one calling pcap_next_ex() for its range of ports? Is the NPF driver designed to separate the packets into multiple kernel buffers and in turn farm them up to a user mode app? Would this be a benefit in performance?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:navy'>Thanks for the help!<o:p></o:p></span></p><p class=MsoNormal><span style='color:navy'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:navy'>Monroe<o:p></o:p></span></p></div></body></html>