<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div>Wrong again. Tutorial 9. See link. <br></div><div><br></div><div>http://www.winpcap.org/docs/docs_412/html/group__wpcap__tut9.html</div><div><br></div><div>Sorry for the number of emails.</div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Kyle Simons <simonskj05@yahoo.com><br> <b><span style="font-weight: bold;">To:</span></b> "Black, Michael (IS)" <Michael.Black2@ngc.com>; "winpcap-users@winpcap.org" <winpcap-users@winpcap.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, July 16, 2012 3:05 PM<br> <b><span
style="font-weight: bold;">Subject:</span></b> Re: [Winpcap-users] Occasional packet loss?<br> </font> </div> <br>
<div id="yiv1188512019"><div><div style="color:#000;background-color:#fff;font-family:times new roman, new york, times, serif;font-size:12pt;"><div>
</div><div class="yiv1188512019MsoNormal">Sorry, here is the site for tutorial 7 I was referring to. <span style=""> </span>And I was incorrect with that.<span style=""> </span>It is actually tutorial 6. I got the “tutorial
6” from the link name.<span style=""> </span></div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">http://www.winpcap.org/docs/docs_412/html/group__wpcap__tut6.html</div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I also added</div>
<div class="yiv1188512019MsoListParagraph" style=""><span style=""><span style="">1.<span style="font:7.0pt;">
</span></span></span>As a global</div>
<div class="yiv1188512019MsoNormal" style="margin-left:.5in;text-indent:.5in;"><span style="font-size:10.0pt;color:blue;">long</span><span style="font-size:10.0pt;">
TotalPackets=0;.<span style=""> </span></span></div>
<div class="yiv1188512019MsoListParagraph" style=""><span style="font-size:10.0pt;"><span style="">2.<span style="font:7.0pt;">
</span></span></span><span style="font-size:10.0pt;">And to the packet handler callback, </span></div>
<div class="yiv1188512019MsoNormal" style=""><span style="font-size:10.0pt;"><span style=""> </span><span style=""> </span><span style="color:green;">// Total Packets</span></span></div>
<div class="yiv1188512019MsoNormal" style=""><span style="font-size:10.0pt;"><span style=""> </span><span style=""> </span><span style=""> </span>Packets.QuadPart =
(*(LONGLONG*)(pkt_data));</span></div>
<div class="yiv1188512019MsoNormal"><span style="font-size:10.0pt;"><span style=""> </span><span style=""> </span>TotalPackets = TotalPackets +
Packets.QuadPart;</span></div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">For data generation, you can use the “winpcap/Examples/PacketDriver/TestPacketSend”
project in the example source code as is.<span style="">
</span></div>
<div><br></div> <div style="font-family:times new roman, new york, times, serif;font-size:12pt;"> <div style="font-family:times new roman, new york, times, serif;font-size:12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> "Black, Michael (IS)" <Michael.Black2@ngc.com><br> <b><span style="font-weight:bold;">To:</span></b> Kyle Simons <simonskj05@yahoo.com>; "winpcap-users@winpcap.org" <winpcap-users@winpcap.org> <br> <b><span style="font-weight:bold;">Sent:</span></b> Monday, July 16, 2012 2:50 PM<br> <b><span style="font-weight:bold;">Subject:</span></b> RE:[Winpcap-users] Occasional packet loss?<br> </font> </div> <br>
<div id="yiv1188512019">
<style>#yiv1188512019 P {
MARGIN-TOP:0px;MARGIN-BOTTOM:0px;}
</style>
<div>
<div style="FONT-FAMILY:Tahoma;DIRECTION:ltr;COLOR:#000000;FONT-SIZE:10pt;">
<div>What is "tutorial 6" ???</div>
<div> </div>
<div>Would you care to share your code so we can see what you're doing?</div>
<div>
<div> </div>
<div style="FONT-FAMILY:Tahoma;FONT-SIZE:13px;">
<div>Michael D. Black<br>
Senior Scientist<br>
Advanced Analytics Directorate<br>
Advanced GEOINT Solutions Operating Unit<br>
Northrop Grumman Information Systems<br>
</div>
</div>
</div>
<hr tabindex="-1">
<div style="DIRECTION:ltr;" id="yiv1188512019divRpF993693"><font face="Tahoma" size="2" color="#000000"><b>From:</b> winpcap-users-bounces@winpcap.org [winpcap-users-bounces@winpcap.org] on behalf of Kyle Simons [simonskj05@yahoo.com]<br>
<b>Sent:</b> Monday, July 16, 2012 1:32 PM<br>
<b>To:</b> winpcap-users@winpcap.org<br>
<b>Subject:</b> EXT :[Winpcap-users] Occasional packet loss?<br>
</font><br>
</div>
<div></div>
<div>
<div style="BACKGROUND-COLOR:#fff;FONT-FAMILY:times new roman, new york, times, serif;COLOR:#000;FONT-SIZE:12pt;">
<div></div>
<div class="yiv1188512019MsoNormal">Hello everyone.<span> </span>I am hoping someone may be able to offer some ideas or suggestions.<span>
</span>Basically, I am seeing some occasional packet loss on the RX side of the NIC and wanted to address it.<span>
</span>Typically, I see the NIC not being able to detect one packet out of 8,000,000 on average.<span>
</span>Maybe this is normal with PC HW/SW limitations???? </div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">The packets I send are the same packet over and over (identical).<span>
</span>Let me do my best explaining what I am seeing and the things I have tried so far.<span>
</span></div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I implemented the packet counters in a few ways.<span> </span>
I see the issue all 3 ways.</div>
<div style="" class="yiv1188512019MsoListParagraph"><span><span>1.<span style="FONT:7pt 'Times New Roman';">
</span></span></span>1. Using the code from tutorial 6 with no filter</div>
<div style="" class="yiv1188512019MsoListParagraph"><span><span>2.<span style="FONT:7pt 'Times New Roman';"> 2.
</span></span></span>Using the code from tutorial 6 with a filter</div>
<div style="" class="yiv1188512019MsoListParagraph"><span><span>3.<span style="FONT:7pt 'Times New Roman';">
</span></span></span>3. Using pcap_stats function.<br>
</div>
<div style="MARGIN-LEFT:0.25in;" class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I like methods 1 and 2 above because I see what the data rate is.<span>
</span>Also allows me to filter.</div>
<div style="MARGIN-LEFT:0.25in;" class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I am generating traffic in multiple ways. All three experience the issue.</div>
<div style="" class="yiv1188512019MsoListParagraph"><span><span>1.<span style="FONT:7pt 'Times New Roman';">
</span></span></span>1. Having the NIC generate traffic and using SmartBits to receive it.<span>
</span>Also I am using the above RX methods to detect packets being sent out.</div>
<div style="" class="yiv1188512019MsoListParagraph"><span><span>2.<span style="FONT:7pt 'Times New Roman';">
</span></span></span>2. Routing cable from one NIC to another in the same PC. So, one NIC sends data out and the other captures (counts) it.</div>
<div style="" class="yiv1188512019MsoListParagraph"><span><span>3.<span style="FONT:7pt 'Times New Roman';">
</span></span></span>3. Using Data Generator Equipment like SmartBits to generate and the PC recieves</div>
<div style="MARGIN-LEFT:0.25in;" class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I have connected an Analyzer (SmartBits) to the NIC on method 1 above and I can see the data generation from the PC is always correct.<span>
</span>The number of packets being sent out (what I am telling it to send) makes it to the SmartBits.<span>
</span>Except I see the occasional packet loss on the NIC (outbound). So, I would think/expect the wpcap software should detect the number of outgoing packets correctly all the time??<span>
</span></div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">On method 2, if I run the analyzer (stats) on both NIC’s, they will mismatch as well.<span>
</span>For example, the second NIC (receiver) counts the right number of packets being sent from the first NIC.<span>
</span>But the first NIC misses one.<span> </span>And vice versa too.</div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">In the method 1 above, I tried both the buffer send method and using the nwrite method.<span>
</span>Same results.</div>
<div style="MARGIN-LEFT:0.25in;" class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I have tried to slow down the traffic.<span> </span>Say 400Mb/s vs 960Mb/s on a 1G NIC.<span>
</span>Slowing it down helps slightly, but does not fix it. </div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">If I change the timeout in the open command from 250 to 2000, not much changes.<span>
</span>If I change it to 5000, it helps.<span> </span>Of course, it is slower to report.<span>
</span>This is true for tutorial 6 code.<span> </span>I am not sure about pcap_stats.<span>
</span>I still need to try it.</div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I tried the snaplen in the open command from 100 to 65000.
<span> </span>I still see the issue.</div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I tried setting the buffer (pcap_setbuff) from 1,000,000 to 4,000,000 to 6,000,000.<span>
</span>Still see the issue.</div>
<div style="MARGIN-LEFT:0.25in;" class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I have tried numerous NICs (5 different ones).</div>
<div style="MARGIN-LEFT:0.25in;" class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I have tried two different machines.<span> </span>One is a Intel I7 3820 (Quad Core) and the other is slower Intel Core 2 6700 (2.67MHZ) 2 GB RAM (Dual Core).<span>
</span>They both behave the same. </div>
<div style="MARGIN-LEFT:0.25in;" class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I used a 10Gig NIC and similar results.<span> </span>It is easier to see the loss because I can send more packets quicker.<span>
</span>Versus on a 1G, it may take 2-3 minutes before I see it.</div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I tried modifying the PC buffers using a tool called “TCPOptimizer”.<span>
</span>Maybe it slightly helps.</div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I created numerous programs: One in C++, one in C#, one using threads, etc. and the issue is still there.</div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">I think that’s it so far with my ideas. <span style="FONT-FAMILY:Wingdings;">
<span>J</span></span><span> </span>Anyone have any suggestions?<span> </span>I know it is only 1 packet every few minutes but 1 packet loss is a big deal for testing too.
</div>
<div class="yiv1188512019MsoNormal"> </div>
<div class="yiv1188512019MsoNormal">Thanks!</div>
</div>
</div>
</div>
</div>
</div><br><br> </div> </div> </div></div></div><br>_______________________________________________<br>Winpcap-users mailing list<br><a ymailto="mailto:Winpcap-users@winpcap.org" href="mailto:Winpcap-users@winpcap.org">Winpcap-users@winpcap.org</a><br><a href="https://www.winpcap.org/mailman/listinfo/winpcap-users" target="_blank">https://www.winpcap.org/mailman/listinfo/winpcap-users</a><br><br><br> </div> </div> </div></body></html>