<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-8859-1"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Nur Text Zchn";
margin:0in;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.NurTextZchn
{mso-style-name:"Nur Text Zchn";
mso-style-priority:99;
mso-style-link:"Nur Text";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText>Hi,<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>I’m currently working on a stream analyzing tool using winpcap. Unfortunately I’m facing the fact of packetloss on my PC...<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>The Setup: 4 streams á 40Mbit/s over a 1GBit/s switch connected to my PC via 3Com 3C996B Gigabit or Intel 82567LM-3 Gigabit NIC (newest drivers of course). The system is powered by a Q9400 with plenty of ram. The CPU usage is below 20%, half of it is used by the kernel. The transport-protocol used is not known by windows, so the frames should not be processed any further.<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>While the hardware should be capable of receiving 160Mbit/s, I’m not able to receive all frames correctly by using Wireshark or my tool. As all frames are numbered, I can see nondeterministic drops of 0-10 frames per second on all streams (The frames are fixed size of 1060 byte).<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>As far as my application goes I tried optimizing kernel- & user-space buffers (both up to 50mb) and only reading the first 32 byte of every frame (pcap_open_live parameter). Also there was no difference between pcap_next_ex, pcap_loop and pcap_dispatch. pcap_stats_ex also tells me no frames have been dropped. The DPC latency without load is about 10µs, using Wireshark or my analyzer (default buffer) will raise the latency up to 30µs. Increasing the buffer size will raise the latency by factor 25. Also applying a filter and only capture one of the streams will result in packetloss...<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Ideas, anyone?<o:p></o:p></p><p class=MsoPlainText><o:p> </o:p></p><p class=MsoPlainText>Kind regards,<o:p></o:p></p><p class=MsoPlainText>Dominik<o:p></o:p></p></div></body></html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre>**********************
** LEGAL DISCLAIMER **
**********************
This E-mail message and any attachments may contain
legally privileged, confidential or proprietary
information. If you are not the intended recipient(s),
or the employee or agent responsible for delivery of
this message to the intended recipient(s), you are
hereby notified that any dissemination, distribution
or copying of this E-mail message is strictly
prohibited. If you have received this message in
error, please immediately notify the sender and
delete this E-mail message from your computer.</pre></font></td></tr></table>