<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style id="owaParaStyle">P {
MARGIN-TOP: 0px; MARGIN-BOTTOM: 0px
}
</style>
</head>
<body ocsi="0" fPStyle="1">
<div style="FONT-FAMILY: Tahoma; DIRECTION: ltr; COLOR: #000000; FONT-SIZE: 10pt">
<p>What is "tutorial 6" ???</p>
<p> </p>
<p>Would you care to share your code so we can see what you're doing?</p>
<div>
<p> </p>
<div style="FONT-FAMILY: Tahoma; FONT-SIZE: 13px">
<p>Michael D. Black<br>
Senior Scientist<br>
Advanced Analytics Directorate<br>
Advanced GEOINT Solutions Operating Unit<br>
Northrop Grumman Information Systems<br>
</p>
</div>
</div>
<hr tabindex="-1">
<div style="DIRECTION: ltr" id="divRpF993693"><font color="#000000" size="2" face="Tahoma"><b>From:</b> winpcap-users-bounces@winpcap.org [winpcap-users-bounces@winpcap.org] on behalf of Kyle Simons [simonskj05@yahoo.com]<br>
<b>Sent:</b> Monday, July 16, 2012 1:32 PM<br>
<b>To:</b> winpcap-users@winpcap.org<br>
<b>Subject:</b> EXT :[Winpcap-users] Occasional packet loss?<br>
</font><br>
</div>
<div></div>
<div>
<div style="BACKGROUND-COLOR: #fff; FONT-FAMILY: times new roman,new york,times,serif; COLOR: #000; FONT-SIZE: 12pt">
<div></div>
<div class="MsoNormal">Hello everyone.<span> </span>I am hoping someone may be able to offer some ideas or suggestions.<span>
</span>Basically, I am seeing some occasional packet loss on the RX side of the NIC and wanted to address it.<span>
</span>Typically, I see the NIC not being able to detect one packet out of 8,000,000 on average.<span>
</span>Maybe this is normal with PC HW/SW limitations???? </div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">The packets I send are the same packet over and over (identical).<span>
</span>Let me do my best explaining what I am seeing and the things I have tried so far.<span>
</span></div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">I implemented the packet counters in a few ways.<span> </span>
I see the issue all 3 ways.</div>
<div style="TEXT-INDENT: -0.25in" class="MsoListParagraph"><span><span>1.<span style="FONT: 7pt 'Times New Roman'">
</span></span></span>1. Using the code from tutorial 6 with no filter</div>
<div style="TEXT-INDENT: -0.25in" class="MsoListParagraph"><span><span>2.<span style="FONT: 7pt 'Times New Roman'"> 2.
</span></span></span>Using the code from tutorial 6 with a filter</div>
<div style="TEXT-INDENT: -0.25in" class="MsoListParagraph"><span><span>3.<span style="FONT: 7pt 'Times New Roman'">
</span></span></span>3. Using pcap_stats function.<br>
</div>
<div style="MARGIN-LEFT: 0.25in" class="MsoNormal"> </div>
<div class="MsoNormal">I like methods 1 and 2 above because I see what the data rate is.<span>
</span>Also allows me to filter.</div>
<div style="MARGIN-LEFT: 0.25in" class="MsoNormal"> </div>
<div class="MsoNormal">I am generating traffic in multiple ways. All three experience the issue.</div>
<div style="TEXT-INDENT: -0.25in" class="MsoListParagraph"><span><span>1.<span style="FONT: 7pt 'Times New Roman'">
</span></span></span>1. Having the NIC generate traffic and using SmartBits to receive it.<span>
</span>Also I am using the above RX methods to detect packets being sent out.</div>
<div style="TEXT-INDENT: -0.25in" class="MsoListParagraph"><span><span>2.<span style="FONT: 7pt 'Times New Roman'">
</span></span></span>2. Routing cable from one NIC to another in the same PC. So, one NIC sends data out and the other captures (counts) it.</div>
<div style="TEXT-INDENT: -0.25in" class="MsoListParagraph"><span><span>3.<span style="FONT: 7pt 'Times New Roman'">
</span></span></span>3. Using Data Generator Equipment like SmartBits to generate and the PC recieves</div>
<div style="MARGIN-LEFT: 0.25in" class="MsoNormal"> </div>
<div class="MsoNormal">I have connected an Analyzer (SmartBits) to the NIC on method 1 above and I can see the data generation from the PC is always correct.<span>
</span>The number of packets being sent out (what I am telling it to send) makes it to the SmartBits.<span>
</span>Except I see the occasional packet loss on the NIC (outbound). So, I would think/expect the wpcap software should detect the number of outgoing packets correctly all the time??<span>
</span></div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">On method 2, if I run the analyzer (stats) on both NIC’s, they will mismatch as well.<span>
</span>For example, the second NIC (receiver) counts the right number of packets being sent from the first NIC.<span>
</span>But the first NIC misses one.<span> </span>And vice versa too.</div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">In the method 1 above, I tried both the buffer send method and using the nwrite method.<span>
</span>Same results.</div>
<div style="MARGIN-LEFT: 0.25in" class="MsoNormal"> </div>
<div class="MsoNormal">I have tried to slow down the traffic.<span> </span>Say 400Mb/s vs 960Mb/s on a 1G NIC.<span>
</span>Slowing it down helps slightly, but does not fix it. </div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">If I change the timeout in the open command from 250 to 2000, not much changes.<span>
</span>If I change it to 5000, it helps.<span> </span>Of course, it is slower to report.<span>
</span>This is true for tutorial 6 code.<span> </span>I am not sure about pcap_stats.<span>
</span>I still need to try it.</div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">I tried the snaplen in the open command from 100 to 65000.
<span> </span>I still see the issue.</div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">I tried setting the buffer (pcap_setbuff) from 1,000,000 to 4,000,000 to 6,000,000.<span>
</span>Still see the issue.</div>
<div style="MARGIN-LEFT: 0.25in" class="MsoNormal"> </div>
<div class="MsoNormal">I have tried numerous NICs (5 different ones).</div>
<div style="MARGIN-LEFT: 0.25in" class="MsoNormal"> </div>
<div class="MsoNormal">I have tried two different machines.<span> </span>One is a Intel I7 3820 (Quad Core) and the other is slower Intel Core 2 6700 (2.67MHZ) 2 GB RAM (Dual Core).<span>
</span>They both behave the same. </div>
<div style="MARGIN-LEFT: 0.25in" class="MsoNormal"> </div>
<div class="MsoNormal">I used a 10Gig NIC and similar results.<span> </span>It is easier to see the loss because I can send more packets quicker.<span>
</span>Versus on a 1G, it may take 2-3 minutes before I see it.</div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">I tried modifying the PC buffers using a tool called “TCPOptimizer”.<span>
</span>Maybe it slightly helps.</div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">I created numerous programs: One in C++, one in C#, one using threads, etc. and the issue is still there.</div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">I think that’s it so far with my ideas. <span style="FONT-FAMILY: Wingdings">
<span>J</span></span><span> </span>Anyone have any suggestions?<span> </span>I know it is only 1 packet every few minutes but 1 packet loss is a big deal for testing too.
</div>
<div class="MsoNormal"> </div>
<div class="MsoNormal">Thanks!</div>
</div>
</div>
</div>
</body>
</html>