[Winpcap-users] pcap_next_ex for real time application

[laurent.charreire at voila.fr]

My application uses only 5% to 35% CPU, depending on what threads are working : some are more cpu consumer...
You will find attached a copy of overall cpu used while my application is running.
Yes, I'm looping in order to handle every packet sniffed.
Here is a sample of my (overloaded) pcaploop method:
void OCA_ThdFiltrage::PcapLoop() {
    DWORD resultat = WaitForMultipleObjects(2, _tabEvt, FALSE, 0);
    [...]
    while (resultat != WAIT_OBJECT_0+1) {
         RetrievePacket(_qCapture);
    }
[...]

where RetrievePacket calls pcap_next_ex as you can see in this sample:
void OCA_ThdFiltrage::RetrievePacket(pcap_t* pdev) {
	struct pcap_pkthdr *pkt_header;
	const u_char *pkt_data;
	int res;

	while((res = pcap_next_ex( pdev, &pkt_header, &pkt_data)) >= 0){
             [...]
        }

I pointed out that there is (fake) packets bursts, then my thread is waiting about 1 sec for new packets (~ 50 packets).
Hence, I suppose that some packets (I logged it : there are about 50 packets) are received and buffered (somewhere in kernel space I suppose). That would be why, on the one hand, my thread is handling so quickly packets and on the other hand, the same thread is waiting for new packets because of the kernel space buffer which may not be enough filled in.
Am I right?
If yes, what can I do to deal with that?

Rgds,

Laurent Charreire


> Message du 30/08/06 à 10h23
> De : "Thomas O'Hare" <Tom at RedTile.Com>
> A : laurent.charreire at voila.fr, winpcap-users at winpcap.org
> Copie à : 
> Objet : Re: [Winpcap-users] pcap_next_ex for real time application
> 
> We just has a question similar in nature.  May I ask what CPU load you
> are using?  IOW, are you looping or using another technique.  I guess %
> of CPU use would be a good indicator.
> 
> Thanks,
> ~ Thomas O'Hare ~
> President, RedTile, Inc. - DBA: RedTile Software
> Web, Wireless, Network, Database & Systems Software
> +1.407.295.9148 ; +49.8651.717950 ; http://www.RedTile.Com/
> Operations Manager; Virtual FoxPro User Group
> Tom at VFUG.Org ; http://www.VFUG.Org/
> 
> 
> laurent.charreire at voila.fr wrote:
> > Hello,
> > I'm developping a real time application (multi-threading with MFC) which aims at decoding RTP packets to create audio file.
> > I make use of pcap_next_ex() in my filtering thread.
> > To test my program, I'm using a rtpdump file (G.711 PCMA) and rtpplay tool.
> > I don't understand why my filtering thread handles packets faster than 20 ms (length of my packet G.711 PCMA): it detects packets every 2 ms... :(
> > As a consequence, my decoding thread can not deal with so many bursts : buffer jitter is getting full and so on.
> > Thanks in advance for your support.
> > http://mail1.voila.fr/webmail/fr_FR/write.html#
> > Envoyer
> > Regards,
> > 
> > Laurent Charreire
> > 
> > _______________________________________________
> > Winpcap-users mailing list
> > Winpcap-users at winpcap.org
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> 
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: cpuLoad.JPG
Type: image/jpeg
Size: 88685 bytes
Desc: not available
Url : http://www.winpcap.org/pipermail/winpcap-users/attachments/20060830/c460594b/cpuLoad-0001.jpeg