[Winpcap-users] EXTERNAL:Re: does the winpcap version 4.1.2 supportthekernelDump feature?

Wed Aug 11 09:49:18 PDT 2010

What makes you think your machine can keep up with 614Mbps?

Just because you have a gig interface does NOT mean you can do gig speeds.

You can use this utility to test your speed between machines.

http://www.netcordia.com/community/files/folders/tools/entry103.aspx

And are you on any kind of switch between them?  That's another limit.

Michael D. Black
Senior Scientist
Advanced Analytics Directorate
Northrop Grumman Information Systems

________________________________

From: winpcap-users-bounces at winpcap.org on behalf of yulou liu
Sent: Wed 8/11/2010 11:17 AM
To: winpcap-users at winpcap.org
Subject: EXTERNAL:Re: [Winpcap-users] does the winpcap version 4.1.2 supportthekernelDump feature?

Hi!

I have a question,  pcap_next_ex() can only get one ethernet packet at a call.  Is there other way that I can read more than  one packet from the user buffer (or kernel buffer)  at one call ? I think maybe that would decrease the packet loss.

Thank you.

2010/8/7 yulou liu <lyulou at gmail.com>

	1. Maybe I didn't make it clear .I don't just want to count , I want to save the data to disk(ramdisk ) too .  At the rate of 614Mbps,  recording  data lasts about 2 minutes.  But I found it began to have packets loss sometimes ,even I just count the packets number.

	2. All the packets from the fpga is 1514,  I made the minitocopy as 8 kytes, kernel buffer and user buffer both as 32MB.

	3. There is still have tcp/ip bound to the netcard , it is recommended to disable it? I will have a try.

	Thank you.    

	? 2010-8-7,1:45,Gianluca Varenni <gianluca.varenni at cacetech.com> ??:

		I'm not 100% sure what the performance problem has to do with the live_dump feature. At those traffic rates you definitely don't want to dump all the packets to disk. If you are just interested in counting the packets, I would use the statistical mode of WinPcap to just count the packets. Follow the sample Examples-remote\tcptop for that.

		Having said, at those rates there is no guarantee that WinPcap will be able to keep up (especially if the packets are small). What is the average packet size that you are analyzing? Did you disable all the bound protocols from the network card used for the capture?

		Have a nice day
		GV

		From: yulou liu <mailto:lyulou at gmail.com>  
		Sent: Friday, August 06, 2010 10:14 AM
		To: <mailto:winpcap-users at winpcap.org> winpcap-users at winpcap.org 
		Subject: Re: [Winpcap-users] does the winpcap version 4.1.2 supportthekernelDump feature?

			yes,i don't want to use an old version either.but there has been a problem that I can't resolve . I made a capture program to collecte datas which are sent from an fpga  . There are several receive threads in the program, each of threads accesses a global netcard port in tern. In order to verify the performace ,it just do the least thing In the receive thread---it just count the amount of  Ethernet frames that it receive. But when the fpga sending  rate increases,especially above 500Mbps, it sometimes loss packets. My question is, is it possible to totally avoid packets loss by optimism the code?  I want to collect datas on the speed 614Mbps without packet loss.   My workstations features with 2 Xeon CPU (each has 4core), 1 G onboard  netcard.   

		Thanks a lot!

			? 2010-8-6,23:58,Gianluca Varenni < <mailto:gianluca.varenni at cacetech.com> gianluca.varenni at cacetech.com> ??:

				I would definitely avoid using an old version of WinPcap (like 3.0alpha2). A huge number of bugs have been fixed since that release, including critical bugs in the driver that could cause OS crashes.

				Have a nice day
				GV

				From: yulou liu <mailto:lyulou at gmail.com> 
				Sent: Thursday, August 05, 2010 7:22 PM
				To:  <mailto:winpcap-users at winpcap.org>  <mailto:winpcap-users at winpcap.org> winpcap-users at winpcap.org
				Subject: Re: [Winpcap-users] does the winpcap version 4.1.2 support thekernelDump feature?

				thanks a lot. 

				I have another question. 
				Is there any possible that I could use the live_dump feature if I install the older version of winpcap ? 

				the following was what I just tried this morning: 

				1.  install the 3.0alpha2-WinPcap.exe   
				2.   download the  "3.0beta-wpdpack.zip"  file  and unzip  , and config VC6 to refer to the lib , include's  directions . 

				Compile the project  which uses  pcap_live_dump().  It was successully compiled . 
				But when I run the .exe file , it can't find the  netcard interfaces. 

				Please  tell me what  mistakes did I make ? 

				Thank you. 

				? 2010-8-6,0:45,Gianluca Varenni < <mailto:gianluca.varenni at cacetech.com>  <mailto:gianluca.varenni at cacetech.com> gianluca.varenni at cacetech.com> ??:

					The live_dump feature has been disabled several years ago (because of other changes in the driver) and no one has worked to support it again. At the moment in order to dump to disk you need to use the standard dump-to-disk mechanism shown in sample "savedump" in the WinPcap developer's pack.

					Have a nice day.

					From: yulou liu <mailto:lyulou at gmail.com> 
					Sent: Thursday, August 05, 2010 9:32 AM
					To:  <mailto:winpcap-users at winpcap.org>  <mailto:winpcap-users at winpcap.org>  <mailto:winpcap-users at winpcap.org> winpcap-users at winpcap.org
					Subject: [Winpcap-users] does the winpcap version 4.1.2 support the kernelDump feature?

					I'm working on a project , that I want to dump packets to the disk .
					I think the pcap_live_dump()  maybe could work in the way I want.
					but it seems the pcap_live_dump() is not supported in the new version of winpcap.
					is it true ??

					thank you.

________________________________

					_______________________________________________
					Winpcap-users mailing list
					<mailto:Winpcap-users at winpcap.org> <mailto:Winpcap-users at winpcap.org> <mailto:Winpcap-users at winpcap.org> Winpcap-users at winpcap.org
					<https://www.winpcap.org/mailman/listinfo/winpcap-users> <https://www.winpcap.org/mailman/listinfo/winpcap-users> <https://www.winpcap.org/mailman/listinfo/winpcap-users> https://www.winpcap.org/mailman/listinfo/winpcap-users

					_______________________________________________
					Winpcap-users mailing list
					<mailto:Winpcap-users at winpcap.org> <mailto:Winpcap-users at winpcap.org> Winpcap-users at winpcap.org
					<https://www.winpcap.org/mailman/listinfo/winpcap-users> <https://www.winpcap.org/mailman/listinfo/winpcap-users> https://www.winpcap.org/mailman/listinfo/winpcap-users

________________________________

				_______________________________________________
				Winpcap-users mailing list
				<mailto:Winpcap-users at winpcap.org> Winpcap-users at winpcap.org
				<https://www.winpcap.org/mailman/listinfo/winpcap-users> https://www.winpcap.org/mailman/listinfo/winpcap-users

				_______________________________________________
				Winpcap-users mailing list
				<mailto:Winpcap-users at winpcap.org> Winpcap-users at winpcap.org
				<https://www.winpcap.org/mailman/listinfo/winpcap-users> https://www.winpcap.org/mailman/listinfo/winpcap-users

________________________________

		_______________________________________________
		Winpcap-users mailing list
		Winpcap-users at winpcap.org
		https://www.winpcap.org/mailman/listinfo/winpcap-users

		_______________________________________________
		Winpcap-users mailing list
		Winpcap-users at winpcap.org
		https://www.winpcap.org/mailman/listinfo/winpcap-users

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/ms-tnef
Size: 15066 bytes
Desc: not available
Url : http://www.winpcap.org/pipermail/winpcap-users/attachments/20100811/a996f5c4/attachment-0001.bin 