[Winpcap-users] Followup question on Old Post

[Gianluca Varenni]

I didn't say that I handle million packets per second. I said that I handle millions of packets with a mechanism similar to WinPcap (i.e. receiving one packet at a time with a call similar to pcap_next_ex).
Consider that at those rates, sometimes the limitation is not just WinPcap, it's the NIC and NIC driver, that are sometimes not optimized to properly handle small packets. In general the idea of using multiple threads and capture instances, each of them capturing a subset of the traffic, is a winning one, as long as you are able to split the traffic evenly among threads.

Have a nice day
GV

From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Neil Powell
Sent: Thursday, March 24, 2011 4:33 PM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Followup question on Old Post

Gianluca,

You mention that you can get WinPCAP to handle millions of packets a second. I'd be very interested to understand the basic idea on how you got WinPCAP to do this.    I have developed an application that currently handles 100,000 packets per second; now I need to scale it up to handle around a 1,000,000 packets per second or more.  The packet size can range from 64bytes to 1514bytes; but typically around 100bytes.  I too have been thinking about using multiple kernel buffers and multiple threads each with a specific filter set.   Is this the ideal way to get the best performance from WinPCAP? If not what philosophy would you suggest? .

Thanks in advance

Neil Powell





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20110324/4c8298cd/attachment.html>