[Winpcap-users] Lost packets on load

[Pelles, Noam]

I use only one thread ( iterate on different  adapters). I am creating
few adapters that all open
the same NIC.


-----Original Message-----
From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Loris Degioanni
Sent: Tuesday, September 27, 2005 10:53 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Lost packets on load

Pelles, Noam wrote:
>
> I am using wpcap.dll , and without that problem it works great.
> The ::SetHWFilter is not called on initialize but only when changing
> the mode ( the default is promiscuous mode which I also use), so I
> don't think this is the problem.
>
> I am using a small mintocopy and timeout of -1.
>
> As far as I can see the Packetyzer does nothing with packet.dll beside

> load it at this stage.
>
> Can it be something with the number of clients I use ? The buffer size
?

What do you mean? Do you have more than a capture thread? Do they use
the same pcap adapter?
I doubt the buffer size can be the cause of the problem.

Loris


>
> Thanks
>
> Noam
>
>
> -----Original Message-----
> From: winpcap-users-bounces at winpcap.org
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Loris
> Degioanni
> Sent: Monday, September 26, 2005 9:50 PM
> To: winpcap-users at winpcap.org
> Subject: Re: [Winpcap-users] Lost packets on load
>
> That may be a way. In a general way, if an application plays with
> OIDs, it should expect somebody else to change the value while it's
running.
>
> Another thing that may happen when you change the timeout and the
> mintocopy to very small values is that another application, using part

> of the CPU, could modify the average kernel buffer occupation and
> therefore the number of copies and system calls. But I see this as a
> very remote option.
>
> Loris
>
>
> Suporte Netcount wrote:
>
>>Won't packetizer call ::SetHwFilter and change your mode even if it
>>doesn't capture? This might affect load/filtering...
>>
>>----- Original Message ----- From: "Loris Degioanni"
>><loris.degioanni at gmail.com>
>>To: <winpcap-users at winpcap.org>
>>Sent: Monday, September 26, 2005 6:42 PM
>>Subject: Re: [Winpcap-users] Lost packets on load
>>
>>
>>
>>>This is very weird.
>>>Are you using wpcap.dll or packet.dll? Did you start from the
>>>examples in the developer's pack? If yes, do they have the same
>>>problem? Unless there's some macroscopic bug that we never spotted,
>>>your application should not interact at all with other processes
>
> using winpcap.
>
>>>Loris
>>>
>>>
>>>Pelles, Noam wrote:
>>>
>>>
>>>> Hi,
>>>> I am writing a network sniffer that uses WinPCap on Win 2000\2003
>>>>servers.
>>>>I have a strange problem which bothers me :
>>>> I am filtering packets according to their IP's and using more than
>>>>one client for that.
>>>>When I decrease network load ( sending packets which are NOT in one
>>>>of my filters - I.e not meant to be captured) I start loosing
>>>>packets that should be captured.
>>>> The lost of packets *STOP* when I open the Packetyzer  application
>>>>( which also uses WinPCap).
>>>>The CPU usage of my application decrease dramatically , but it is no
>
>
>>>>longer loose packets !! ( even if the Packetyzer does not capture
>>>>packets at all..).
>>>>I have tried to download the source code of packetyzer , but could
>>>>not succeed ( any one have this source ??).
>>>> Does any one know what can cause this behavior ? what settings can
>>>>effect other application that uses WinPCap( beside mode) ?
>>>>Any one familiar with settings that can cause this problem ??
>>>> Thanks
>>>> **
>>>>____________________________________________________________________
>>>>______________________
>>>>
>>>>This electronic message contains information from Verint Systems,
>>>>which may be privileged and confidential.
>>>>The information is intended to be for the use of the individual(s)or
>
>
>>>>entity named above.
>>>>If you are not the intended recipient, be aware that any disclosure,
>
>
>>>>copying, distribution or use of the contents of this information is
>>>>prohibited.
>>>>If you have received this electronic message in error, please notify
>
>
>>>>us by replying to this email (1).
>>>>
>>>>
>>>>--------------------------------------------------------------------
>>>>----
>>>>
>>>>_______________________________________________
>>>>Winpcap-users mailing list
>>>>Winpcap-users at winpcap.org
>>>>https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>
>>>_______________________________________________
>>>Winpcap-users mailing list
>>>Winpcap-users at winpcap.org
>>>https://www.winpcap.org/mailman/listinfo/winpcap-users
>>
>>
>>_______________________________________________
>>Winpcap-users mailing list
>>Winpcap-users at winpcap.org
>>https://www.winpcap.org/mailman/listinfo/winpcap-users
>>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> ______________________________________________________________________
> ____________________ This electronic message contains information from

> Verint Systems, which may be privileged and confidential.
> The information is intended to be for the use of the individual(s)or
entity named above.
> If you are not the intended recipient, be aware that any disclosure,
copying, distribution or use of the contents of this information is
prohibited.
> If you have received this electronic message in error, please notify
us by replying to this email (1).
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

__________________________________________________________________________________________
This electronic message contains information from Verint Systems, which may be privileged and confidential.
The information is intended to be for the use of the individual(s)or entity named above.
If you are not the intended recipient, be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited.
If you have received this electronic message in error, please notify us by replying to this email (1).