[Winpcap-users] Performance

Betsy Riggins epriggin at us.ibm.com
Fri Jul 20 20:07:24 GMT 2007


We are writing a tool that will basically pull IP packets from the 
network, do some modifications and put the modified packet back on the 
network.  We are writing this for multiple OSes and we see that 
performance on Windows is really poor compared to the other OSes. I wanted 
to check our design to find the most efficient method and also solicit for 
any ideas about what would improve performance. We see very low CPU usage, 
memory is also not constrained but packet throughput is low. We have 
executed on single and multi-cpus with little difference in throughput.

We have two different version, both showing the same performance.
Design #1, 
        Find adapter and open each using pcap_open (InterfaceName, 1600,
                               PCAP_OPENFLAG_PROMISCUOUS | 
PCAP_OPENFLAG_NOCAPTURE_LOCAL | PCAP_OPENFLAG_MAX_RESPONSIVENESS,
                               3600, NULL, errbuf);
        pcap_setmintocopy to 0
        Spin off thread(s) to loop reading / modifying /sending packets 
(we have changed the number of threads and performance seems to decrease 
as threads increase)
                pcap_next_ex 
                Modify
                pcap_sendpacket

Design #2 
        Open adapter pcap_open_live capture timeout 0
        pcap_setmintocopy to 0 
        Start threads (have tried 1 to 10, performance decreases with 
threads increasing) :
                calls pcap_loop
                callback modifies packet
                          pcap_sendpacket
 
We have tried increasing thread priority but it did not make a significant 
performance improvement. The modify packet code is common to linux and 
windows so we don't think that the problem lies in that portion of the 
code. We are running tests on 1Gb/s  ethernet and we are using the same 
hardware for both tests. Linux is showing around 100Mb/s windows is around 
10Mb/s.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20070720/caefdfc3/attachment.htm


More information about the Winpcap-users mailing list