[Winpcap-users] EXT : WinPCAP Packet ordering

[Guy Harris]

On Feb 25, 2011, at 12:09 PM, Gianluca Varenni wrote:

> Finally (and even if you have two machines with a direct Ethernet cable, no switches/routers…) you can still “receive” packets out-of-order when running on a multicore system. The reason is that the NIC itself receives the packets probably in order, but then the NIC driver and OS will try to distribute the received packets among all the CPUs on the system. WinPcap (in its kernel driver) will receive packets concurrently on multiple cores, and will put all the packets in the same buffer. It has no way of knowing which packet was actually received first by the NIC (and has no way to control such behavior).

...and the packets will be time stamped early enough that they might not be put in the WinPcap buffer in time stamp order?  (If so, think of it as compatibility with Linux. :-)  That behavior has shown up on Linux MP machines as well - and, in the shiny new world of multi-core processors, lots of recent x86-based personal computers are MP, perhaps even the majority of them.)