[Winpcap-users] How can i get the new-estpacketfrombuffer?HELPPLEASE~!

[David Chang]

If the other machine is sending a constant 200,000 packets per second and won't slow down, you may be out of luck.  However, if the other machine sends 200,000 packet per second for a short burst (say 10 seconds), then you should be able to store those 2M packets into your own memory space.  After you store the packets, you can do your analysis.

For a quick test, just change your control loop to do...

static int counter;

pcap_next_ex(...);
counter++;

That is, don't do anything with the packet (other than advance the buffer and count how many you receive).  This will tell you how fast your machine can move through the buffer.

If this works well, then you need to do a memcpy() of the packet into pre-allocated space (i.e. malloc your own circular queue).  This will slow down the loop, but should be much faster than 0.1ms.

Last question:  Most packet capturing applications need to decode EVERY packet, are you saying that you do NOT need to decode every packet?  If not, how do you know which packets you need to decode and which ones you don't?

DC

  ----- Original Message ----- 
  From: rst 
  To: winpcap-users at winpcap.org 
  Sent: Monday, May 25, 2009 11:31 PM
  Subject: Re: [Winpcap-users] How can i get the new-estpacketfrombuffer?HELPPLEASE~!


  There is a machine, It send packets to my application , and the speed is fixed 
  (about 200000 packets/per second = 0.000005 second for a packet),
  the packet include some informations, my application need the informations to do realtime control.

  my application need 0.0001 second (0.1 ms) to finish a control loop,
  when the application doing control,  it need "current" information.
  but because the buffer, I always got the oldest information in buffer,
  so i can't do the realtime control.

  Does any function can clear buffer?
  or decrease the buffer size ?
  or stop capture packet for awhile ( let the incoming packets drops immediacy, don't fill into buffer )?

  another question, how large is the buffer size?

  ----- Original Message ----- 
    From: David Chang 
    To: winpcap-users at winpcap.org 
    Sent: Tuesday, May 26, 2009 1:59 PM
    Subject: Re: [Winpcap-users] How can i get the new-est packetfrombuffer?HELPPLEASE~!


    I don't think there is a way to get to the front of the queue to get the latest packet.  You have to sequentially read through the queue.

    Can you explain what your application is doing?  When you say you want the newest packet, what does that mean (i.e. each packet received is the newest packet at that moment in time)?

    DC


------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-users mailing list
  Winpcap-users at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20090526/030f9df9/attachment-0001.htm