[Winpcap-users] NPF Device Driver

[Gianluca Varenni]

  ----- Original Message ----- 
  From: Alessandro Capucci 
  To: winpcap-users at winpcap.org 
  Sent: Friday, April 10, 2009 3:18 AM
  Subject: [Winpcap-users] NPF Device Driver


  Hello to every body,
  I'm new in WinPCap library... I'm study it for an interesting new project... 10GBit deep packet inspection. I'm try to connect directly with WinPCap NPF driver for best performance. All work fine on my 1GBit adapter! Next week I'll hope to star test with 10GBit adapter.


By "connecting directly to the WinPcap Driver" you mean calling the Packet API directly?


  I've some question: 

  0) Do you think that NPF driver with a good hardware can be able to capture 10GBit ethernet packet without sensible packet lost ?


No, I don't think so. Capturing at 10Gbps, expecially in the worst case i.e. 64byte packets, it's an extremely challenging task. Even custom capture cards (which cost thousands of dollars) have a very hard time dealing with such an amount of packets.

  1) Packet.dll functions are callable in multithread applications ? For example can I call PacketReceivePacket or PacketGetStats  in two different concurent thread on the same device ? Are serialized ?

In general the functions are not thread safe when working on the same LPADAPTER structure.

  2) WinPCap NPF drive is able to take advantage of RSS (Receive Side Scaling)  availble in Win2008 server (http://msdn.microsoft.com/en-us/library/ms795609.aspx)?

No.

Have a nice day
GV



  Tnk you very much!
  Alessandro



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090410/b83eea11/attachment.htm