[Winpcap-users] sniffing multiple interfaces

[Black, Michael (IS)]

What kind of data rates are you throwing at the interfaces?
What kind of CPU usage do you see when running single and multiple threads?



Michael D. Black
Senior Scientist
Advanced Analytics Directorate
Advanced GEOINT Solutions Operating Unit
Northrop Grumman Information Systems

________________________________
From: winpcap-users-bounces at winpcap.org [winpcap-users-bounces at winpcap.org] on behalf of Vasanth Neel [vsn.vasanth at gmail.com]
Sent: Wednesday, November 21, 2012 2:11 AM
To: winpcap-users at winpcap.org
Subject: EXT :[Winpcap-users] sniffing multiple interfaces

Hello Everyone,

I had a requirement to sniff multiple interfaces to rtp pckets. Our application is stable when we sniff single interface but when i try to sniff multiple interface from single or multiple thread each opens the pcap_t devices seperately and uses pcap_next_ex to read the packets i got packet loss in large amount. i have tried to set the timeot to different levels like from 1 to 500 nothing seems to work.. here is the code sample that process the the multiple interfaces,

while(IsRunning())
 {

  pcap_pkthdr* header;
  const u_char* pkt_data;
  bool bProcess = true;
  if(pcap_next_ex(m_hPcap1,&header,&pkt_data) >= 0)
  {
    ETHERNETHEADER* pEthernetHeader = (ETHERNETHEADER *) pkt_data;
    IPHEADER* pIpHeader = (IPHEADER*)((char*)pEthernetHeader + sizeof(ETHERNETHEADER));
    u_char* ipPacketEnd = (u_char*)pIpHeader + ntohs(pIpHeader->ip_len);
    PacketSize = (ipPacketEnd - pkt_data)+100; // winpcap padding

    u_char* pPacket = (u_char*) malloc(PacketSize);
    memcpy(pPacket,pkt_data,PacketSize);
    m_SafeQueue.Enqueue(pPacket);
  }
  if(pcap_next_ex(m_hPcap2,&header,&pkt_data) >= 0)
  {
    ETHERNETHEADER* pEthernetHeader = (ETHERNETHEADER *) pkt_data;
    IPHEADER* pIpHeader = (IPHEADER*)((char*)pEthernetHeader + sizeof(ETHERNETHEADER));
    u_char* ipPacketEnd = (u_char*)pIpHeader + ntohs(pIpHeader->ip_len);
    PacketSize = (ipPacketEnd - pkt_data)+100; // winpcap padding

    u_char* pPacket = (u_char*) malloc(PacketSize);
    memcpy(pPacket,pkt_data,PacketSize);
    m_SafeQueue.Enqueue(pPacket);
  }
}


What i am doing wrong in this? also i have seems some suggestion to use waitformultipleevents but i am not sure how to do that. any suggestions appreciated.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20121121/93e74e1c/attachment.html>