[Winpcap-users] Problem with dropped packets

[Morrow, Carson]

Thanks for getting back to me.

The number of packets dropped changes as I change the WinPcap buffer and
kernel copy size. The kernel driver buffer is for the NPF driver,
correct? Are packets that are lost in the NPF driver buffer counted in
the pcap_stats_ex data, or does it just count packets dropped from the
user buffer in winpcap.dll?

Thanks,
Carson

-----Original Message-----
Date: Thu, 19 Aug 2010 11:12:37 -0700
From: "Gianluca Varenni" <gianluca.varenni at cacetech.com>
Subject: Re: [Winpcap-users] Problem with dropped packets
To: <winpcap-users at winpcap.org>
Message-ID: <C9C0F2D266CE4C96B6D70FADA496851F at NELSON3>
Content-Type: text/plain; charset="iso-8859-1"

Carson,

if the dropped packet count is zero, then it means that the packets do
not reach the winpcap driver at all, so WinPcap is not dropping the
packets. Possible reasons are:

1. the packets are somewhat corrupted (wrong FCS) and the NIC drops them
2. the packets have the wrong dest MAC address (and since you are not
using promiscuous mode, they are not received by WinPcap)
3. either the NIC card or the NIC card driver cannot keep up at those
rates.

Have a nice day
GV