[Winpcap-users] Can winpcap capture that fast?

[Gianluca Varenni]

You are probably losing packets because you are dumping to disk. Disks are 
**slow**, they cannot ususally keep up dumping 400k packets per second. I 
would try creating a simple application that simply counts the packets and 
see if you keep losing packets.

If you need to dump to disk, I suggest you looking at the slides of this 
presentation

http://www.cacetech.com/SHARKFEST.08/BoF_Varenni_%20WinPcap%20Do's%20and%20Don'ts.zip

In particular the slide titled "dumping to disk" gives some hints on it.

Have a nice day
GV

----- Original Message ----- 
From: "Zafer SAVAS" <zsavas at aselsan.com.tr>
To: <winpcap-users at winpcap.org>
Sent: Tuesday, April 29, 2008 6:46 AM
Subject: [Winpcap-users] Can winpcap capture that fast?


> Hello,
>
> I have a question about the recording capability of the Winpcap library:
> I want to monitor a gigabit ethernet link where a large amount of data is 
> flowing (430.000 MAC Layer packets/second).
> When I observe my network connection status for incoming and outgoing 
> packets using the windows LAN connection on the system tray, I see that 
> exactly 430.000 packets are received. However when I want to record them 
> using my c program, I can only record 20.000 of them.
>
> So, do you think I am doing something wrong or is this the maximum speed 
> of the library?
>
> P.S : I am already using the dump file utility of the library for fast 
> recording.
>
> Best Regards
> Zafer
>
> ######################################################################
> Dikkat:
>
> Bu elektronik posta mesaji kisisel ve ozeldir. Eger size
> gonderilmediyse lutfen gondericiyi bilgilendirip mesaji siliniz.
> Firmamiza gelen ve giden mesajlar virus taramasindan gecirilmekte,
> guvenlik nedeni ile kontrol edilerek saklanmaktadir. Mesajdaki
> gorusler ve bakis acisi gondericiye ait olup Aselsan A.S. resmi
> gorusu olmak zorunda degildir.
>
> ######################################################################
> Attention:
>
> This e-mail message is privileged and confidential. If you are
> not the intended recipient please delete the message and notify
> the sender. E-mails to and from the company are monitored for
> operational reasons and in accordance with lawful business practices.
> Any views or opinions presented are solely those of the author and
> do not necessarily represent the views of the company.
>
> ######################################################################
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users