[Winpcap-users] winpcap performance

[Gianluca Varenni]

  ----- Original Message ----- 
  From: Charu Agrawal 
  To: winpcap-users at winpcap.org 
  Sent: Wednesday, January 14, 2009 5:40 PM
  Subject: [Winpcap-users] winpcap performance


  Hi,

   

  I am trying to get the best performance out of winpcap library.

   

  We are capturing huge frames(each frame is 30 MB) over the Ethernet interface using winpcap library.



What do you mean by "30MB frame"?? A frame over Ethernet has a maximum size of roughly 1500 bytes. Do you mean "conversation"?

   

  I need to apply filtering to capture only relevant frames. I use the following filter.

   

  "src  192.168.x.x"

   

  I am using a 1Gig dedicated Ethernet interface for the packet capture. 1 frame comprises of nearly 22,330 packets ( for the 30MB frame).

   

  I am able to capture 1 frame in nearly 20s. If I remove the filtering time improves to 5s. 



What do you mean by that? Are all the frames IP frames? what's the L4 protocol?



GV



  But I need to use the filtering to get only specific packets.

  Is there an alternate way to do this ? is there some way I can improve the performance ?



  I greatly appreciate your help

   

  Thanks

  Charu Agrawal



------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090121/d128e2d8/attachment-0001.htm