[Winpcap-users] Is pcap_next_ex() buffer circular?

[Rich Detering]

At 02:44 PM 9/25/2006, you wrote:
>The best way is not to have to flush it in the first place.  Are you
>getting more packets than you need to get?

The short answer is yes, we get more packets than we need.  The proprietary 
hardware is continuously transmitting packets at the rate of 220 packets 
per second (approx. 170 bytes/sec).  We are only interested in a small 
sample of the packets after changing the measurement setup in the 
proprietary hardware.  This happens every 1 or 2 seconds.

It looks like my choices are either to continuously call pcap_next_ex() in 
a parallel thread and buffer the data in my app.  Or for every measurement, 
perform a pcap open/read/close operation.

With regard to promiscuous mode, the proprietary hardware is connect to 
it's own NIC, so I've assumed that promiscuous  or non-promiscuous would 
have little effect on the traffic load.