<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:575625215;
mso-list-type:hybrid;
mso-list-template-ids:-1052742190 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='color:#1F497D'><span style='mso-list:Ignore'>1)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:#1F497D'>I wouldn’t expect any performance hit. I have code similar to that that handles millions of packets per second. A call to pcap_next_ex does not correspond to a transition user-kernel. Packets are received in user space in big buffers, so you might well have 1 syscall every hundreds (if not more) packets.<o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='color:#1F497D'><span style='mso-list:Ignore'>2)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:#1F497D'>No. <o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='color:#1F497D'><span style='mso-list:Ignore'>3)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:#1F497D'>The assumption is correctly. At those rates I would not expect any drop if you are using a decent NIC and you are fast enough at processing the packets.<o:p></o:p></span></p><p class=MsoListParagraph style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='color:#1F497D'><span style='mso-list:Ignore'>4)<span style='font:7.0pt "Times New Roman"'> </span></span></span><![endif]><span style='color:#1F497D'>It’s definitely a supported configuration. The driver would use a different buffer per thread (and the buffer will contain only the filtered packets).<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Have a nice day<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>GV<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> winpcap-users-bounces@winpcap.org [mailto:winpcap-users-bounces@winpcap.org] <b>On Behalf Of </b>Monroe Comstock<br><b>Sent:</b> Friday, March 18, 2011 6:23 AM<br><b>To:</b> winpcap-users@winpcap.org<br><b>Subject:</b> [Winpcap-users] Followup question on Old Post<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi everyone,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This is a follow up question to an old post (Dec of 2008).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>*<b>BEGIN OLD POST</b>*<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><pre>><i> On Wed, Dec 10, 2008 at 12:30 PM, Gianluca Varenni<o:p></o:p></i></pre><pre>><i> <<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users">gianluca.varenni at cacetech.com</a>> wrote:<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>><i> ----- Original Message ----- From: "Victor Ginzburg" <o:p></o:p></i></pre><pre>>><i> <<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users">vginzburg at gmail.com</a>><o:p></o:p></i></pre><pre>>><i> To: <<a href="https://www.winpcap.org/mailman/listinfo/winpcap-users">winpcap-users at winpcap.org</a>><o:p></o:p></i></pre><pre>>><i> Sent: Monday, December 08, 2008 11:25 AM<o:p></o:p></i></pre><pre>>><i> Subject: [Winpcap-users] pcap_next_ex<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>>><i> Hi All,<o:p></o:p></i></pre><pre>>>><i><o:p> </o:p></i></pre><pre>>>><i> Is there any way to pick-up multiple packets with one call rather than<o:p></o:p></i></pre><pre>>>><i> one packet at a time with pcap_next_ex?<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>><i> No, at the moment there's no API for that.<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>>><i> And if yes, is there big<o:p></o:p></i></pre><pre>>>><i> performance improvement in terms using less CPU?<o:p></o:p></i></pre><pre>>><i><o:p> </o:p></i></pre><pre>>><i> The performance improvement would be minimal. What is the packet rate <o:p></o:p></i></pre><pre>>><i> that<o:p></o:p></i></pre><pre>>><i> we are talking about?<o:p></o:p></i></pre><pre>><i><o:p> </o:p></i></pre><pre>><i> around 2000 per second<o:p></o:p></i></pre><pre><o:p> </o:p></pre><pre>At 2k packets per second forget about any performance improvement receiving <o:p></o:p></pre><pre>multiple packets within one call. If you have any performance problems, they <o:p></o:p></pre><pre>are definitely not due to the calls to pcap_next_ex returning one packet at <o:p></o:p></pre><pre>a time.<o:p></o:p></pre><pre><o:p> </o:p></pre><pre>Have a nice day<o:p></o:p></pre><pre>GV<o:p></o:p></pre><pre><o:p> </o:p></pre><p class=MsoNormal>*<b>END OLD POST</b>*<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Question 1) I have an application that will need to retrieve 50k packets/second (all UDP, all ~200 bytes, coming from a range of ports, for which I will use a filter). Will using pcap_next_ex() in this case cause a performance hit? IE Does it have to transition to kernel mode for getting each packet? Or has it pulled a buffer from the kernel such that it's just reading the copied buffer until it is exhausted? Then subsequently reading the kernel buffer again? If it has to transition to kernel mode what is the cost for making 50000 transitions in per second?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Question 2) Is there now or is there planned a way to read all the packets that are available in one call so that I can process all of them from a single call to pcap_next_ex() or some similar function?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Question 3) If the answer to #2 is no, and the call to pcap_next_ex() only calls into the kernel periodically to retrieve the buffer and as long as my thread can keep up with processing the buffer, then I would assume that I would have no packet loss from the kernel buffer. Is this a correct assumption?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Question 4) Is it possible/worthwhile to setup multiple threads to each have a filter that is a subset of the entire range of ports that need to be captured such that I can divvy up the work on a multiple core machine with each one calling pcap_next_ex() for its range of ports? Is the NPF driver designed to separate the packets into multiple kernel buffers and in turn farm them up to a user mode app? Would this be a benefit in performance?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:navy'>Thanks for the help!<o:p></o:p></span></p><p class=MsoNormal><span style='color:navy'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:navy'>Monroe<o:p></o:p></span></p></div></body></html>