[Winpcap-users] Performance issues and c# wrappers

[Black, Michael (IS)]

I don't know what kind of network you're on.

But 100mbit/sec is nothing anymore.



Today's switches have gigabit ports to interconnect them because the ports can all do 100Mbit EACH for example.  One 100Mbit port can't watch fast enough to capture the traffic that can occur on the switch.



So you really have to either bond ports together or sit on the gigabit port to capture traffic.



Nonetheless -- you'll want to multitrread your application for writing to disk.



You can probably get by without that for 100Mbit/sec (that's only 12MB/sec to disk which should be a doable sustained rate on a single thread).  But if your disk I/O pauses too long you may drop things.



You can tell that by running a ping while blasting data at it and the looking to see if you capture all the pings.

Or better, by running a small test program which sends 10 packets a second or such and ensure you see all the packets while blasting data on the network.







Michael D. Black

Senior Scientist

NG Information Systems

Advanced Analytics Directorate



________________________________
From: winpcap-users-bounces at winpcap.org [winpcap-users-bounces at winpcap.org] on behalf of Emre Erişgen [emreerisgen at gmail.com]
Sent: Wednesday, July 13, 2011 6:09 AM
To: winpcap-users at winpcap.org
Subject: EXT :[Winpcap-users] Performance issues and c# wrappers

I want to write a program which will listen the network device and capture packets and saves them as dump files. The problem is packet loss must be really really small in high transfer rates. What is the maximum transfer rate for winpcap library? Can i capture 100mbit/sec without packet loss? I have to write this program with C# so by wrapping winpcap for using in C# will decrease the program performance? Do you know the performance of wrappers like pcp.net<http://pcp.net/> and sharppcap? By performance i mean maximum transfer rate without packet loss. Any help will be appreciated. Thank you for reading.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110713/7c8d7dd1/attachment.html>