[Winpcap-users] MODE_STAT

[Fitt, Jonathan]

Thanks GV.
 
Is the callback function called immediately when a stat report is
compiled?
 
The reason I ask is: if I have a 100ms sample time and use a system
timer to log when the callback is called it is pretty reliably every
100ms, but when I log the report header timestamps they are mainly every
100ms, but occasionally 800ms or -600ms!
 
As an example:
Report header time/      packets in report /     difference from last
header time
1197065236.922320         64      103.069782
1197065237.228180         62      305.860043
1197065237.132800         67      -95.379829
1197065237.242820         68      110.019922
1197065237.343190         63      100.369930
1197065237.450960         67      107.769966
1197065237.553170         64      102.210045
1197065237.653380         62      100.209951
1197065237.753430         62      100.049973
1197065237.853580         62      100.150108
1197065237.953730         62      100.150108
1197065238.538680         61      584.949970
1197065238.154090         62      -384.590149
1197065238.254160         61      100.070000
1197065238.364150         63      109.990120
1197065238.464530         64      100.379944
1197065238.564680         62      100.150108
1197065238.664820         62      100.139856
1197065238.764970         62      100.150108
 
I am stressing it by flooding the captured address with lots of large
udp packets, but can you think why I would occasionally be seeing that
the report was 3* or 5* a capture period from the last one, or maybe 3*
a capture period before it?
Even if I sort the reports by header time, it's still not reliably every
100ms.
 
Thanks,
 
Jonathan

________________________________

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Friday, December 07, 2007 3:56 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] MODE_STAT


The timestamp is generated when the stat reports are computed in the
driver.
 
While in the callback function, the packets are buffered by the kernel
buffer managed by the WinPcap kernel driver, npf.sys. In particular, if
you are in statistical mode, packets are not actually buffered at all,
the driver receives the packets from the OS, updates the statistics and
releases the packet. This update is completely independent from the
callback function.
 
Have a nice day
GV
 

	----- Original Message ----- 
	From: Fitt, Jonathan <mailto:Jonathan.Fitt at anritsu.com>  
	To: winpcap-users at winpcap.org 
	Sent: Thursday, December 06, 2007 2:11 PM
	Subject: [Winpcap-users] MODE_STAT

	My question is about using pcap in statistical mode.
	 
	The timeval attached to the stat report header, when exactly is
that time?
	Is it the time the capture started, or timed out?
	 
	Also, while in the callback function are all packets
received/sent buffered up so that they'll appear in the next report?
	I don't want to miss any while in the callback function.
	 
	Thanks,
	 
	Jonathan

	
________________________________


	

	_______________________________________________
	Winpcap-users mailing list
	Winpcap-users at winpcap.org
	https://www.winpcap.org/mailman/listinfo/winpcap-users
	

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20071207/a0a21b56/attachment-0001.htm