[Winpcap-users] Performance issues, please help

[Ioan Popescu]

popa andrei wrote:
> Hello,
> I am working on an IDS project for Windows XP. I am using WinPcap to 
> sniff packets from 1 network adapter. The project is build in Visual 
> Studio 2008 / NET Framework 3. The capturing thread is a 
> BackgroundWorker which uses pcap_next_ex to capture pachets. For each 
> packet, I have to get tcp/udp information and store it in a hashtable, 
> so there are only a few operations that needs to be done for each packet.
> When I test the application on high traffic (>2MB/sec), the Mem Usage 
> becomes ridiculously high, after 10 mins : 600-1000MB of RAM used, and 
> 30-40 processor usage, and Growing :(  What can be the cause of that ? I 
> don't save packet data in memory...
> Does the pkt_data pointer has to be de-allocated in some way after 
> processing information?

Have you tried simplifying your test case? For example, run only the capture 
thread, without doing any processing. That'll at least help determine where 
to look.

Also, which WinPcap version are you using? And what .NET wrapper, if any? 
Maybe the wrapper isn't marshaling correctly.