[Winpcap-users] Strange behavior of pcap_next_ex

[Gianluca Varenni]

----- Original Message ----- 
From: "Jens Munk" <j.munk at maccor.com>
To: <winpcap-users at winpcap.org>
Sent: Friday, December 05, 2008 3:06 PM
Subject: Re: [Winpcap-users] Strange behavior of pcap_next_ex


> Thank you so much. Now it works and give full speed.
>
> I have an additional question. The data can be pulled out with both
> "pcap_next_ex" and a call back function loaded with "pcap_loop". Is
> there any advantage of one over the other? My main concern is lost
> packages. I do really, really need to get them all.
>

I usually suggest pcap_next_ex over pcap_loop because it's much easier to 
use.

As far as performance is concerned, there's basically an additional function 
call (maybe two?) when you use pcap_next_ex vs. pcap_loop, but I definitely 
wouldn't be concerned about it.
We have used pcap_next_ex to receive at 1.5M packets per second without any 
problem.

Let me know if you need any further detail.

Have a nice day
GV


> Jens.
>
>
>>>
>>> In my application, I am using pcap_sendpacket to send a raw packagage to
>>> a networked microcontroller that is within a millisecond or so sending
>>> another raw package as a reply (old microcontroller -> not IP), and I
>>> can verify with the WireShark that this is working just fine. However,
>>> the behavior of pcap_next_ex is not the way I expect. Due to its
>>> blocking nature I have it sitting in a separate thread, so that should
>>> be OK, but it doesn't return anything before it sees some kind of an IP
>>> message like an ARP. Then, however, it keeps returning all the raw
>>> messages since the last appearance of an IP message.
>>>
>>> Is this the way it is supposed to be or am I doing something wrong?
>>>
>>
>> Please remember that there is a parameter called mintocopy.
>> pcap_next_ex will not return until
>> - the timeout elapses (timeout that you chose in pcap_open_live)
>> - at least mintocopy bytes have been received (default value =
>> 16000bytes)
>> (whatever happens first).
>>
>> I would try to change the mintocopy value (pcap_setmintocopy) to a
>> very small value and see what happens.
>>
>> Have a nice day
>> GV
>>
>>
>>
>


--------------------------------------------------------------------------------


> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>