[Winpcap-users] CPU usage

[Guy Harris]

Victor Ginzburg wrote:

> I have a problem with CPU usage with a relatively high traffic,
> 1500-2000 packets a second. I have an application in which I disabled
> everything but pcap_next_ex while loop. If I set up a filter that
> sniffs packets from one IP 192.168.1.1-255.255.255.255, the CPU usage
> is very low, but if I open the network like 192.168.0.0-255.255.0.0,
> the CPU usage grows to 6-7 percent while it sniffs the packets on an
> average 2-3GHz machine.

I.e., if more packets pass the packet filter, more CPU time is spent?

This is not surprising, as packets that don't pass the filter are, in 
systems where the filtering is done in the kernel - and Windows with 
WinPcap is one of those systems - not copied into the capture mechanisms 
internal buffer and thus not copied to userland when pcap_loop() or 
pcap_dispatch() or pcap_next() or pcap_next_ex() is out of packets in 
its buffer and reads more from the kernel.

(Yes, the copies are still done even if you just call pcap_next_ex() and 
discard the packet data.)