[Winpcap-users] Re: reducing dropped packets

[David Chang]

I know this subject has been talked about before, but what is the current 
state of the art for libpcap / winpcap for reducing the number of dropped 
packets?

My understanding is that winpcap allows the programmer to change the kernel 
buffer for packet capture (pcap_setbuff).  What is a reasonable setting for 
that (are there trade-offs or can I set it to something arbitrarily high if 
I have a lot of RAM)?  In a June 2006 message, Loris mentions
the only reason why changing the size of the buffers could
slow your application down is caching issuesWhat does 'caching issues' mean? 
If you don't have enough RAM, the other process will swap?

Does libpcap allow pcap_setbuff() now?  If so, for which O.S.?

Also, how can I minimize the amount of effort it takes the hardware to 
receive a packet (better NIC, faster CPU, etc), pass it up to the kernel 
(O.S. kernel settings), winpcap to filter the packet (winpcap filter 
expression and other API settings), and my application to receive that 
packet (use pcap_next instead of pcap_dispatch, etc)?  Again, are there 
differences between winpcap and libpcap for those setting?

My application is not realtime, so I'm primarily interested in throughput. 
That is, what the most traffic I can keep up with.  If there's a few 
milliseconds of delay, that's fine with me.

I searched through the 2006 winpcap-users archives and there are a few 
helpful messages, but nothing complete.  Any help would be appreciated.

DC