[Winpcap-users] winpcap support for TOE?

[Bryan Kadzban]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Athir Nuaimi wrote:
> Does anyone know if winpcap support network cards that use TOE?

It "supports" them just fine (nothing crashes), but capturing doesn't
deliver any packets.  Of course, neither does MS's "Network Monitor"
packet sniffer, FWIW.

The reason is probably in the WinPcap FAQ, but I'll repeat it here
anyway: Both netmon and winpcap are installed in a Windows system as
protocol drivers.  TCP offloading happens exclusively within the network
card's driver and the network hardware; therefore, no protocol driver
(including tcpip.sys, I believe) is able to see the packets.  Therefore,
no protocol driver is able to capture them either.

And no, there's no way to fix this: the reason that TOE is faster is
that the operating system isn't involved in processing each packet.  But
in order to capture any given packet (...or firewall it, for that
matter!), the OS *must* be involved.

I assume you've already done testing under load, with and without TOE,
and that testing has determined that you really do need it?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHnSAAS5vET1Wea5wRAw6OAKDSH2atKzOHA7bW81lUgXBUCFypGQCgrQtD
jz46nPU815RnOL9oG7zNNCs=
=8ySJ
-----END PGP SIGNATURE-----