[Winpcap-users] Statistical mode help

[pro2c]

Boaz: it needs .Net 3.5

 

Thank you anyway

 

  _____  

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Boaz Brickner
Sent: Monday, April 12, 2010 10:23 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

Have you tried Pcap.Net?
http://pcapdotnet.codeplex.com

Boaz.

On Mon, Apr 12, 2010 at 23:06, pro2c <pro2c at litrca.com> wrote:

No, I didn't write the wrapper. But this is the only one for .NET 2.0
(sharppcap)  :-(

 

  _____  

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni


Sent: Monday, April 12, 2010 9:50 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

The reason is probably in the .NET wrapper itself, then. Opening around 100
pcap instances is something that I've never tried, but it might definitely
impact the overall system performance.

If you have written the .NET wrapper yourself, I would look into optimizing
its code.

 

Have a nice day

GV

 

 

 

From: pro2c <mailto:pro2c at litrca.com>  

Sent: Monday, April 12, 2010 12:40 PM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

I'm doing this in VB.NET 2005 (.NET 2.0) and with 1,5Mbyte/sec (~3000
packets/sec)  the cpu load is very high.

 

  _____  

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 9:31 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

Then you should definitely be able to process that amount of packets with a
simple user mode application that sorts the packets by TCP port.

 

Have a nice day

GV

 

From: pro2c <mailto:pro2c at litrca.com>  

Sent: Monday, April 12, 2010 12:15 PM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

Not much. Traffic of an average computer... about 15Mbit down and 15 up

 

  _____  

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 9:02 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

How much traffic are we talking about? 

 

Have a nice day

GV

 

From: pro2c <mailto:pro2c at litrca.com>  

Sent: Monday, April 12, 2010 11:55 AM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

I already did this (capture all packets and sorted them on their ports) but
it was too slow when downloading at full speed. So I turned to statistics as
I only need the bytes up/down per port. 

There are about 100 active ports on average, so 100 instances would be
neccessary...

 

  _____  

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 8:50 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

It depends on the number of instances. For sure I wouldn't open 64k
instances to monitor all the ports. I would capture all the packets (i.e. no
statistics mode) and write my own code to disssect the packets and compute
the statistics.

 

GV

 

 

From: pro2c <mailto:pro2c at litrca.com>  

Sent: Monday, April 12, 2010 11:42 AM

To: winpcap-users at winpcap.org 

Subject: Re: [Winpcap-users] Statistical mode help

 

Thank you for your reply!

 

One more question: are several instances heavy on the cpu?...can I monitor
all the computer's ports without stressing the cpu too much?

 

  _____  

From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Monday, April 12, 2010 8:37 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Statistical mode help

 

you need to use several instances.

 

Have a nice day

GV

 

From: pro2c <mailto:pro2c at litrca.com>  

Sent: Monday, April 12, 2010 11:24 AM

To: winpcap-users at winpcap.org 

Subject: [Winpcap-users] Statistical mode help

 

Hello

 

I've set the stats filter to monitor several tcp ports. I recieve only the
data for all these ports together and I wish to be able to get the
individual data for each port. Is this possible with 1 instance or do I have
to create one instance of winpcap for every port?

 

Thanx

Michael

  _____  

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

  _____  

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

  _____  

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

  _____  

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

  _____  

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users


_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20100412/b657e64b/attachment-0001.htm