[Winpcap-users] NPF Device Driver

[Gianluca Varenni]

----- Original Message ----- 
From: "Alessandro Capucci" <alessandro at totalwire.it>
To: "Gianluca Varenni" <gianluca.varenni at cacetech.com>
Cc: <winpcap-users at winpcap.org>
Sent: Monday, April 13, 2009 12:35 PM
Subject: Re: [Winpcap-users] NPF Device Driver


Hi,
I think to use kernel buffer used percentage to investigate the
corretct size to set to the kernel buffer...

BUT.... I begin to suspect that WinPCap driver is not the good
solution for try to investigate 10GBit DPI (deep packet inspection).

I think that I'll try to develope a NDIS 6.2 protocol driver to
analize if exists a possibility to develope a 10GBit DPI using a not
extreme expensive device like DAG (quite 30K$) but using intel low
cost device (2K$).

Do you think that ther's a possibility to investigate 10Gbit packet
with a Win2008 server + NDIS 6.2 protocol driver and a very good
server hardware (quad core, ecc... )?

--GV--
I think you will end up with something like winpcap. Are you looking to work 
at full 10Gbps speed or just 4-5Gbps?

Have a nice day
GV





Tnk for your support,
Alessandro

Il giorno 13/apr/09, alle ore 20:22, Gianluca Varenni ha scritto:

> Answers inline, marked as "--GV--"
>
> Have a nice day
> GV
>
> PS: please reply to the mailing list as well.
>
>
> ----- Original Message ----- From: Alessandro Capucci
> To: Gianluca Varenni
> Sent: Saturday, April 11, 2009 5:03 AM
> Subject: Re: [Winpcap-users] NPF Device Driver
>
>
> Tnk, I reply to you inline in this mail in RED.
>
>
>
>
> Il giorno 10/apr/09, alle ore 21:12, Gianluca Varenni ha scritto:
>
>
>
> ----- Original Message -----
> From: Alessandro Capucci
> To: winpcap-users at winpcap.org
> Sent: Friday, April 10, 2009 3:18 AM
> Subject: [Winpcap-users] NPF Device Driver
>
>
> Hello to every body,
> I'm new in WinPCap library... I'm study it for an interesting new 
> project... 10GBit deep packet inspection. I'm try to connect  directly 
> with WinPCap NPF driver for best performance. All work fine  on my 1GBit 
> adapter! Next week I'll hope to star test with 10GBit  adapter.
>
> By "connecting directly to the WinPcap Driver" you mean calling the 
> Packet API directly?
> -> YES, I'm connecting directly to NPF driver via Packet32.c  interface (I 
> haven't use Packet.dll). I'm using Vista, but next week  I'll try Windows 
> Server 2008 to take advantage of NDIS 6.2 and RSS.
>
> --GV--
> I wouldn't actually do that. Unless you modify npf.sys to become an  NDIS 
> 6 protocol driver, npf.sys is an NDIS 5 driver. On Vista/2008  NDIS5 is 
> "emulated" on top of NDIS6 with an adaptation shim. So you  might actually 
> incur into a perf hit.
> --GV--
>
> I've some question:
>
> 0) Do you think that NPF driver with a good hardware can be able to 
> capture 10GBit ethernet packet without sensible packet lost ?
>
> No, I don't think so. Capturing at 10Gbps, expecially in the worst  case 
> i.e. 64byte packets, it's an extremely challenging task. Even  custom 
> capture cards (which cost thousands of dollars) have a very  hard time 
> dealing with such an amount of packets.
> -> Tnk, i'll try benchmark WinPCap NPF Driver with generalpurpose 
> ethernet adapter like PCI-Express Intel® 10 Gigabit XF SR Server  Adapters 
> (with RSS enabled)  VERSUS an specialized card like DAG by  Endace.
>
>
> 1) Packet.dll functions are callable in multithread applications ?  For 
> example can I call PacketReceivePacket or PacketGetStats  in two 
> different concurent thread on the same device ? Are serialized ?
> In general the functions are not thread safe when working on the  same 
> LPADAPTER structure.
> ->Ok tnk, I'll put it in critical section.
>
> --GV--
> If performance is your main objective, then putting a critical  section 
> might again hurt performance. I would be careful with that.
>
> --GV--
>
>
> 2) WinPCap NPF drive is able to take advantage of RSS (Receive Side 
> Scaling) availble in Win2008 server 
> (http://msdn.microsoft.com/en-us/library/ms795609.aspx)?
> No.
> ANOTHER QUESTION:
> Next week I'll try to introduce another value in the information 
> callback, not only Packet Received and Packet Dropped but percentage  of 
> use of the kernel circular buffer for CPU. I think that this  value could 
> be usefull to tuning Kernel side buffer size.
> Do you think that could be usefull to introduce in your public 
> distribution?
>
>
> --GV--
> How would you use it?
>
> GV
>
> --GV--
>
>
>
>
> Have a nice day
> GV
>
>
> Tnk you very much!
> Alessandro
>
>
>
>
>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users