[Winpcap-users] Statistical mode help

[Gianluca Varenni]

Then you should definitely be able to process that amount of packets with a simple user mode application that sorts the packets by TCP port.

Have a nice day
GV


From: pro2c 
Sent: Monday, April 12, 2010 12:15 PM
To: winpcap-users at winpcap.org 
Subject: Re: [Winpcap-users] Statistical mode help


Not much. Traffic of an average computer... about 15Mbit down and 15 up

 


--------------------------------------------------------------------------------

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 9:02 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

How much traffic are we talking about? 

 

Have a nice day

GV

 

From: pro2c 

Sent: Monday, April 12, 2010 11:55 AM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

I already did this (capture all packets and sorted them on their ports) but it was too slow when downloading at full speed. So I turned to statistics as I only need the bytes up/down per port. 

There are about 100 active ports on average, so 100 instances would be neccessary...

 


--------------------------------------------------------------------------------

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 8:50 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

It depends on the number of instances. For sure I wouldn't open 64k instances to monitor all the ports. I would capture all the packets (i.e. no statistics mode) and write my own code to disssect the packets and compute the statistics.

 

GV

 

 

From: pro2c 

Sent: Monday, April 12, 2010 11:42 AM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

Thank you for your reply!

 

One more question: are several instances heavy on the cpu?...can I monitor all the computer's ports without stressing the cpu too much?

 


--------------------------------------------------------------------------------

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 8:37 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

you need to use several instances.

 

Have a nice day

GV

 

From: pro2c 

Sent: Monday, April 12, 2010 11:24 AM

To: winpcap-users at winpcap.org 

Subject: [Winpcap-users] Statistical mode help

 

Hello

 

I've set the stats filter to monitor several tcp ports. I recieve only the data for all these ports together and I wish to be able to get the individual data for each port. Is this possible with 1 instance or do I have to create one instance of winpcap for every port?

 

Thanx

Michael


--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users


--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users


--------------------------------------------------------------------------------

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users



--------------------------------------------------------------------------------


_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20100412/a3f58343/attachment.htm