[Winpcap-users] pcap_setbuff occasional failure

Thu Jun 4 09:29:24 PDT 2009

Thanks.  Also can you think of anything in the application that we
should do or should not do that might cause this?  The error happens
very rarely so it is hard to catch.

We are using separate pcap_t handles for each thread.

Ed Sassone

CONFIDENTIALITY NOTICE: This communication and any files or attachments
transmitted with it contain information that is confidential to the
sender and/or Autonomy, Inc., privileged or exempt from disclosure under
applicable law. It is intended solely for the use of the individual or
the entity to which it is addressed. If you are not the intended
recipient(s), you are hereby notified that any use, dissemination, or
copying of this communication is strictly prohibited; please do not
read, copy, use or disclose the content of this communication to others.
If you have received this communication in error, please delete it and
contact our network administrator at (214) 981-3100.  Thank you.

________________________________

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Wednesday, June 03, 2009 2:36 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] pcap_setbuff occasional failure

The buffer is on an open-instance basis, not on a NIC basis. So it's
perfectly safe to have two threads setting different buffer sizes on the
same adapter, *provided* that you are using two different pcap_t
handles. 

Having said that, without a task manager screenshot it's impossible to
understand why it failed. The error basically means that a malloc in the
kernel driver failed, but it's impossible to know why without more
information about the memory load at the time of the failure...

Have a nice day

GV

	----- Original Message ----- 

	From: Sassone, Ed <mailto:Ed.Sassone at autonomy.com>  

	To: winpcap-users at winpcap.org 

	Sent: Monday, June 01, 2009 7:33 AM

	Subject: Re: [Winpcap-users] pcap_setbuff occasional failure

	We finally caught the error.  We did not get the Task Manager
screen shot.  Also you are correct in that serializing the
initialization did not help.

	One thing interesting, we have two threads per NIC card setting
different buffer sizes.  The first allocation worked and the second did
not.  The bracketed number is the thread id.

	05/29 14:24:54.53 Interface.cpp:93: [00001A54] Set buffer size
to 1048576 for interface
\Device\NPF_{F4E3EFD7-CAB0-481B-86E3-874358548A34} : Signaling Interface

	05/29 14:24:54.53 Interface.cpp:85: [00001174] Could not set
buffer size to 5242880 for interface
\Device\NPF_{F4E3EFD7-CAB0-481B-86E3-874358548A34}: driver error: not
enough memory to allocate the kernel buffer

	Ed Sassone

	www.autonomy.com <http://www.autonomy.com/> 

	CONFIDENTIALITY NOTICE: This communication and any files or
attachments transmitted with it contain information that is confidential
to the sender and/or Autonomy, Inc., privileged or exempt from
disclosure under applicable law. It is intended solely for the use of
the individual or the entity to which it is addressed. If you are not
the intended recipient(s), you are hereby notified that any use,
dissemination, or copying of this communication is strictly prohibited;
please do not read, copy, use or disclose the content of this
communication to others. If you have received this communication in
error, please delete it and contact our network administrator at (214)
981-3100.  Thank you.

________________________________

	From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Sassone, Ed
	Sent: Wednesday, October 08, 2008 3:12 PM
	To: winpcap-users at winpcap.org
	Subject: RE: [Winpcap-users] pcap_setbuff occasional failure

	Essentially a critical section around all the adapter
initialization calls so it will only be in one set a time, across all
threads and adapters.  Unfortunately I didn't have it print the
pcap_geterr string.  I just put that in.  It may be awhile until we
catch it in the act.

	thanks

	Ed Sassone

	From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
	Sent: Wednesday, October 08, 2008 2:05 PM
	To: winpcap-users at winpcap.org
	Subject: Re: [Winpcap-users] pcap_setbuff occasional failure

	Serializing pcap_setbuff should not be necessary (serializing
against what? multiple calls on the same adapter? on the same pcap_t
handle?).

	Expecially considering that the only solution is a reboot, I
would think that there is some sort of leak either in the WinPcap driver
or in some other driver in the system. What's the exact error message
returned by pcap_setbuff?

	Also, after the problem occurs and before rebooting, open Task
Manager, go to the Performance Tab and send me a screenshot of it, if
possible.

	Have a nice day

	GV

		----- Original Message ----- 

		From: Sassone, Ed <mailto:Ed.Sassone at autonomy.com>  

		To: winpcap-users at winpcap.org 

		Sent: Monday, October 06, 2008 2:15 PM

		Subject: [Winpcap-users] pcap_setbuff occasional failure

		Hi

		Every so often in our application during startup, the
pcap_setbuff call will fail.  We are unable to re-create the problem but
it seems to happen after the application has been stopped and started a
number of times.  Once the failure occurs it will continue to occur,
until a reboot.  Our app is multithreaded with two threads starting per
interface card, and we can have more than one interface card configured.
The buffer size specified can vary but it's usually around 5-10 MB.  I
have recently put in some changes to serialize the command in case there
is a timing issue, as I'm not sure if the call is thread safe.  I
remember there was thread issue with the filter command.  This is on
Windows 2003.  Any other ideas?  

		thanks

		Ed Sassone

________________________________

		_______________________________________________
		Winpcap-users mailing list
		Winpcap-users at winpcap.org
		https://www.winpcap.org/mailman/listinfo/winpcap-users

________________________________

	_______________________________________________
	Winpcap-users mailing list
	Winpcap-users at winpcap.org
	https://www.winpcap.org/mailman/listinfo/winpcap-users

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090604/636093df/attachment-0001.htm 