[Winpcap-users] Winpcap-users Digest, Vol 72, Issue 8

Anton Tremsin ast at ssl.berkeley.edu
Wed Mar 23 19:43:25 PDT 2011 

Hi Gianluca,

You are right again, my comment was not correct. I looked at the 
timestamps of all 64 packets in Wireshark to answer your question. What 
have looked reliable to me first, now shows that there was some delay in 
the data receiving sequence, but I cannot tell precisely where that 
delay happens (at which packet number) and how long it is (changes from 
one data set to another and it is hard to find where the gap is).  
Wireshark shows all 64 packets at once, which looked fine as if there 
was no delays.

What is strange in my receiving code now is the following: data comes 
with something like 57 - 62 packets, then there is delay equal to the 
timeout parameter which I set in the open function. Then the rest of the 
data comes. No timeout error shows up in that case. It is only after the 
last packet was received the timeout events show up in the   
pcap_next_ex() return parameter.

May be it is all in the card driver and I cannot get any help from 
Chelsio support, after describing the situation to them. For now I set 
the timeout to 1 ms, and handle many timeout events when I do not have 
data coming in. That seems to be not an elegant solution, but somewhat 
sufficient for the alpha version of our data acquisition. I am trying to 
borrow another card (from different manufacturer) to test whether it is 
indeed in the card driver. What puzzles me is why setmintocopy() does 
not any effect in my code?

Thanks,

Anton
>
> Anton,
>
> You say that "Wireshark grabs data fast and reliably". What do you 
> mean by that? Do you look at the timestamps in wireshark to say that 
> it's reliable?
>
> Have a nice day
>
> GV
>
> *From:* winpcap-users-bounces at winpcap.org 
> [mailto:winpcap-users-bounces at winpcap.org] *On Behalf Of *Anton Tremsin
> *Sent:* Wednesday, March 16, 2011 9:24 AM
> *To:* winpcap-users at winpcap.org
> *Subject:* Re: [Winpcap-users] Winpcap-users Digest, Vol 72, Issue 8
>
> Hi Akif,
>
> I have not tried packet.h,  but I see the same behavior: Wireshark 
> grabs data fast and reliably, while my code using C library has those 
> delays, which I cannot get rid of. I can receive ~55 packets (8K each) 
> reliably, with no any delays, but for 64 of them I always have a 
> delay. setmintocopy does not change anything, as in your case. I also 
> changed the buffer size , that does not change the delay either, once 
> it is large enough.
>
> I am stack and really do not know what I can do. I talked to the 
> manufacturer of my card (Chesio), but they have no idea why that 
> happens either.
>
> Anton
>
> Hi,
>
> The only thing that amazes me is Wireshark. Why is wireshark able to 
> capture with such accuracy even if it uses winpcap.
>
> Is it possible to achieve accuracy if i used packet.h functions to 
> receive and then pcap to send the packets. Anton have you tried that?
>
> BR
>
>
>
> > From: winpcap-users-request at winpcap.org 
> <mailto:winpcap-users-request at winpcap.org>
> > Subject: Winpcap-users Digest, Vol 72, Issue 8
> > To: winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
> > Date: Wed, 16 Mar 2011 02:08:28 -0700
> >
> > Send Winpcap-users mailing list submissions to
> > winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
> >
> > To subscribe or unsubscribe via the World Wide Web, visit
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> > or, via email, send a message with subject or body 'help' to
> > winpcap-users-request at winpcap.org 
> <mailto:winpcap-users-request at winpcap.org>
> >
> > You can reach the person managing the list at
> > winpcap-users-owner at winpcap.org <mailto:winpcap-users-owner at winpcap.org>
> >
> > When replying, please edit your Subject line so it is more specific
> > than "Re: Contents of Winpcap-users digest..."
> >
> >
> > Today's Topics:
> >
> > 1. Re: PPP capture (Gianluca Varenni)
> > 2. Re: Winpcap-users Digest, Vol 72, Issue 7 (Akif Usman)
> >
> >
> > ----------------------------------------------------------------------
> >
> > Message: 1
> > Date: Tue, 15 Mar 2011 13:59:25 -0700
> > From: Gianluca Varenni <Gianluca.Varenni at riverbed.com> 
> <mailto:Gianluca.Varenni at riverbed.com>
> > To: Anton Tremsin <ast at ssl.berkeley.edu> 
> <mailto:ast at ssl.berkeley.edu>, "winpcap-users at winpcap.org" 
> <mailto:winpcap-users at winpcap.org>
> > <winpcap-users at winpcap.org> <mailto:winpcap-users at winpcap.org>
> > Subject: Re: [Winpcap-users] PPP capture
> > Message-ID:
> > <6A8F2E88CFF83C43A6AFF7FAC775B9FC07151743D9 at MAILBOXES2.nbttech.com> 
> <mailto:6A8F2E88CFF83C43A6AFF7FAC775B9FC07151743D9 at MAILBOXES2.nbttech.com>
> > Content-Type: text/plain; charset="us-ascii"
> >
> > Anton,
> >
> > If I remember well, you are capturing from Ethernet, Akif is 
> capturing from PPP. The code paths for the two types of devices are 
> completely different (Ethernet goes through the WinPcap kernel driver, 
> PPP gets captured through Netmon).
> >
> > Have a nice day
> > GV
> >
> > From: Anton Tremsin [mailto:ast at ssl.berkeley.edu]
> > Sent: Monday, March 14, 2011 11:43 PM
> > To: winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
> > Cc: Gianluca Varenni
> > Subject: Re: [Winpcap-users] PPP capture
> >
> > Akif, Gianluca,
> >
> > As I mentioned in my previous messages, I have exactly the same 
> problem of delayed packages, with mintocopy set even to 0 (tried other 
> values as well). I am always sending a set of 64 packets of 8Kbytes 
> each (that is one image data). The packets are not lost, they always 
> arrive. However, some of them come with no delay (varied number of 
> them, sometimes 62, sometimes 57, etc), while the rest of them come 
> exactly after the delay equal to the setting of the timeout, which I 
> varied between 1 and 10000 milliseconds. There is no timeout reported 
> for the packets to arrive with the delay.
> >
> > I will be very glad if that issue can be solved, which has probably 
> the same cause as in Akif's application.
> >
> > Thanks a lot,
> >
> > Anton
> >
> > Akif,
> >
> > This is probably due to the mintocopy and timeout of WinPcap. 
> WinPcap does not deliver you the packets immediately after they are 
> received by the driver. Packets are batched in kernel mode and 
> delivered to the receiving application when
> >
> >
> > There are at least mintocopy bytes in the kernel buffer
> >
> > After a certain timeout
> > (whatever happens first).
> >
> > In order to reduce the delay, you will need to either reduce the 
> timeout or the mintocopy.
> >
> > Have a nice day
> > GV
> >
> > From: winpcap-users-bounces at winpcap.org 
> <mailto:winpcap-users-bounces at winpcap.org><mailto:winpcap-users-bounces at winpcap.org> 
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Akif Usman
> > Sent: Thursday, March 10, 2011 11:20 AM
> > To: winpcap-users at winpcap.org 
> <mailto:winpcap-users at winpcap.org><mailto:winpcap-users at winpcap.org>
> > Subject: [Winpcap-users] PPP capture
> >
> > HI,
> >
> > I have installed the winpcap version 3.1 beta and i am capturing 
> from a PPP interface and it captures perfectly. Now i am trying to 
> capture from the same PPP interface using my LIBPCAP program and 
> forward it to another Ethernet interface that connects further to a 
> second computer (Ethernet NIC) which also has wireshark running on it. 
> When i capture from the second computer i get a strange offset of 0.5 
> seconds after every x packets. This is very strange. I dont know why 
> wireshark is able to capture from PPP interface on the first computer 
> with proper accuracy and why my LIBPCAP program, which is just 
> forwarding the packets, is introducing a 0.5s [:-O] delay. Please help 
> me out as soon as somebody can.
> >
> > Best Regards
> > Fika
> >
> >
> >
> >
> >
> > _______________________________________________
> >
> > Winpcap-users mailing list
> >
> > Winpcap-users at winpcap.org 
> <mailto:Winpcap-users at winpcap.org><mailto:Winpcap-users at winpcap.org>
> >
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> >
> >
> >
> > -------------- next part --------------
> > An HTML attachment was scrubbed...
> > URL: 
> <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110315/7cb51127/attachment-0001.html>
> >
> > ------------------------------
> >
> > Message: 2
> > Date: Wed, 16 Mar 2011 10:08:25 +0100
> > From: Akif Usman <akif.usman at hotmail.com> 
> <mailto:akif.usman at hotmail.com>
> > To: <winpcap-users at winpcap.org> <mailto:winpcap-users at winpcap.org>
> > Subject: Re: [Winpcap-users] Winpcap-users Digest, Vol 72, Issue 7
> > Message-ID: <SNT143-w3812119493BFBBEDF1C2EC80CE0 at phx.gbl> 
> <mailto:SNT143-w3812119493BFBBEDF1C2EC80CE0 at phx.gbl>
> > Content-Type: text/plain; charset="iso-8859-1"
> >
> >
> > HI,
> > There are some questiosn i need to ask. Why does wireshark give no 
> delay upon capture even though it uses Winpcap?
> > I am using windows xp for capture and i have checked the capture on 
> ethernet and there seems to be no problems at all from the capture on 
> ethernet. I have tried changing mintocopy and the timeout but it gives 
> me no changes in the performance? Any ideas why?
> >
> > BR
> >
> > > From: winpcap-users-request at winpcap.org 
> <mailto:winpcap-users-request at winpcap.org>
> > > Subject: Winpcap-users Digest, Vol 72, Issue 7
> > > To: winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
> > > Date: Tue, 15 Mar 2011 12:00:02 -0700
> > >
> > > Send Winpcap-users mailing list submissions to
> > > winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
> > >
> > > To subscribe or unsubscribe via the World Wide Web, visit
> > > https://www.winpcap.org/mailman/listinfo/winpcap-users
> > > or, via email, send a message with subject or body 'help' to
> > > winpcap-users-request at winpcap.org 
> <mailto:winpcap-users-request at winpcap.org>
> > >
> > > You can reach the person managing the list at
> > > winpcap-users-owner at winpcap.org 
> <mailto:winpcap-users-owner at winpcap.org>
> > >
> > > When replying, please edit your Subject line so it is more specific
> > > than "Re: Contents of Winpcap-users digest..."
> > >
> > >
> > > Today's Topics:
> > >
> > > 1. Re: PPP capture (Gianluca Varenni)
> > > 2. Re: PPP capture (Anton Tremsin)
> > >
> > >
> > > ----------------------------------------------------------------------
> > >
> > > Message: 1
> > > Date: Mon, 14 Mar 2011 18:44:54 -0700
> > > From: Gianluca Varenni <Gianluca.Varenni at riverbed.com> 
> <mailto:Gianluca.Varenni at riverbed.com>
> > > To: "winpcap-users at winpcap.org" <mailto:winpcap-users at winpcap.org> 
> <winpcap-users at winpcap.org> <mailto:winpcap-users at winpcap.org>
> > > Subject: Re: [Winpcap-users] PPP capture
> > > Message-ID:
> > > 
> <6A8F2E88CFF83C43A6AFF7FAC775B9FC07151739AA at MAILBOXES2.nbttech.com> 
> <mailto:6A8F2E88CFF83C43A6AFF7FAC775B9FC07151739AA at MAILBOXES2.nbttech.com>
> > > Content-Type: text/plain; charset="us-ascii"
> > >
> > > Akif,
> > >
> > > This is probably due to the mintocopy and timeout of WinPcap. 
> WinPcap does not deliver you the packets immediately after they are 
> received by the driver. Packets are batched in kernel mode and 
> delivered to the receiving application when
> > >
> > >
> > > - There are at least mintocopy bytes in the kernel buffer
> > >
> > > - After a certain timeout
> > > (whatever happens first).
> > >
> > > In order to reduce the delay, you will need to either reduce the 
> timeout or the mintocopy.
> > >
> > > Have a nice day
> > > GV
> > >
> > > From: winpcap-users-bounces at winpcap.org 
> <mailto:winpcap-users-bounces at winpcap.org> 
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Akif Usman
> > > Sent: Thursday, March 10, 2011 11:20 AM
> > > To: winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
> > > Subject: [Winpcap-users] PPP capture
> > >
> > > HI,
> > >
> > > I have installed the winpcap version 3.1 beta and i am capturing 
> from a PPP interface and it captures perfectly. Now i am trying to 
> capture from the same PPP interface using my LIBPCAP program and 
> forward it to another Ethernet interface that connects further to a 
> second computer (Ethernet NIC) which also has wireshark running on it. 
> When i capture from the second computer i get a strange offset of 0.5 
> seconds after every x packets. This is very strange. I dont know why 
> wireshark is able to capture from PPP interface on the first computer 
> with proper accuracy and why my LIBPCAP program, which is just 
> forwarding the packets, is introducing a 0.5s [:-O] delay. Please help 
> me out as soon as somebody can.
> > >
> > > Best Regards
> > > Fika
> > > -------------- next part --------------
> > > An HTML attachment was scrubbed...
> > > URL: 
> <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110314/fcd4e478/attachment-0001.html>
> > >
> > > ------------------------------
> > >
> > > Message: 2
> > > Date: Mon, 14 Mar 2011 23:42:30 -0700
> > > From: Anton Tremsin <ast at ssl.berkeley.edu> 
> <mailto:ast at ssl.berkeley.edu>
> > > To: winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
> > > Cc: Gianluca Varenni <Gianluca.Varenni at riverbed.com> 
> <mailto:Gianluca.Varenni at riverbed.com>
> > > Subject: Re: [Winpcap-users] PPP capture
> > > Message-ID: <4D7F0A56.1070207 at ssl.berkeley.edu> 
> <mailto:4D7F0A56.1070207 at ssl.berkeley.edu>
> > > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed"
> > >
> > > Akif, Gianluca,
> > >
> > > As I mentioned in my previous messages, I have exactly the same 
> problem
> > > of delayed packages, with mintocopy set even to 0 (tried other 
> values as
> > > well). I am always sending a set of 64 packets of 8Kbytes each 
> (that is
> > > one image data). The packets are not lost, they always arrive. 
> However,
> > > some of them come with no delay (varied number of them, sometimes 62,
> > > sometimes 57, etc), while the rest of them come exactly after the 
> delay
> > > equal to the setting of the timeout, which I varied between 1 and 
> 10000
> > > milliseconds. There is no timeout reported for the packets to arrive
> > > with the delay.
> > >
> > > I will be very glad if that issue can be solved, which has 
> probably the
> > > same cause as in Akif's application.
> > >
> > > Thanks a lot,
> > >
> > > Anton
> > > >
> > > > Akif,
> > > >
> > > > This is probably due to the mintocopy and timeout of WinPcap. 
> WinPcap
> > > > does not deliver you the packets immediately after they are 
> received
> > > > by the driver. Packets are batched in kernel mode and delivered 
> to the
> > > > receiving application when
> > > >
> > > > - There are at least mintocopy bytes in the kernel buffer
> > > >
> > > > - After a certain timeout
> > > >
> > > > (whatever happens first).
> > > >
> > > > In order to reduce the delay, you will need to either reduce the
> > > > timeout or the mintocopy.
> > > >
> > > > Have a nice day
> > > >
> > > > GV
> > > >
> > > > *From:* winpcap-users-bounces at winpcap.org 
> <mailto:winpcap-users-bounces at winpcap.org>
> > > > [mailto:winpcap-users-bounces at winpcap.org] *On Behalf Of *Akif Usman
> > > > *Sent:* Thursday, March 10, 2011 11:20 AM
> > > > *To:* winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
> > > > *Subject:* [Winpcap-users] PPP capture
> > > >
> > > > HI,
> > > >
> > > > I have installed the winpcap version 3.1 beta and i am capturing 
> from
> > > > a PPP interface and it captures perfectly. Now i am trying to 
> capture
> > > > from the same PPP interface using my LIBPCAP program and forward 
> it to
> > > > another Ethernet interface that connects further to a second 
> computer
> > > > (Ethernet NIC) which also has wireshark running on it. When i 
> capture
> > > > from the second computer i get a strange offset of 0.5 seconds 
> after
> > > > every x packets. This is very strange. I dont know why wireshark is
> > > > able to capture from PPP interface on the first computer with 
> proper
> > > > accuracy and why my LIBPCAP program, which is just forwarding the
> > > > packets, is introducing a 0.5s [:-O] delay. Please help me out 
> as soon
> > > > as somebody can.
> > > >
> > > > Best Regards
> > > >
> > > > Fika
> > > >
> > > >
> > > > _______________________________________________
> > > > Winpcap-users mailing list
> > > > Winpcap-users at winpcap.org <mailto:Winpcap-users at winpcap.org>
> > > > https://www.winpcap.org/mailman/listinfo/winpcap-users
> > > >
> > >
> > > -------------- next part --------------
> > > An HTML attachment was scrubbed...
> > > URL: 
> <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110314/fde1d594/attachment-0001.html>
> > >
> > > ------------------------------
> > >
> > > _______________________________________________
> > > Winpcap-users mailing list
> > > Winpcap-users at winpcap.org <mailto:Winpcap-users at winpcap.org>
> > > https://www.winpcap.org/mailman/listinfo/winpcap-users
> > >
> > >
> > > End of Winpcap-users Digest, Vol 72, Issue 7
> > > ********************************************
> >
> > -------------- next part --------------
> > An HTML attachment was scrubbed...
> > URL: 
> <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110316/cd1b5258/attachment.html>
> >
> > ------------------------------
> >
> > _______________________________________________
> > Winpcap-users mailing list
> > Winpcap-users at winpcap.org <mailto:Winpcap-users at winpcap.org>
> > https://www.winpcap.org/mailman/listinfo/winpcap-users
> >
> >
> > End of Winpcap-users Digest, Vol 72, Issue 8
> > ********************************************
>
>   
>   
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org  <mailto:Winpcap-users at winpcap.org>
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>    
>
>
>
>
> -- 
>   
> Anton S. Tremsin, Ph.D.
> Space Sciences Laboratory
> University of California at Berkeley
> Berkeley, CA 94720
> Tel: (510) 642 4554
>   
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>    

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110323/c501b164/attachment-0001.html>

More information about the Winpcap-users mailing list