[Winpcap-users] pcap_next_ex starts returning timeout after 4+ hours of capture

[Bekiares Tyrone-CTB041]

Hi,

I'm using winpcap to capture a ~3mb/s stream of UDP packets. We need to capture for long periods (e.g., 24 hours); our application processes the payload, extracts statistics, and logs the statistics to disk over time. This usually works for about 4 or so hours, and then repeated calls to pcap_next_ex() return timeout (no data), and finally stop returning altogether (block). Notably, I'm certain data is still coming in (I can see it in wireshark).

The app is written in java, and I've written a JNI interface in VS2010 which bridges Java to the winpcap.dll API. I believe we are seeing the problem on a relatively modern HP workstation w/ built-in Intel GB/s NICs, under Win7/64, running WinPcap 4.1.2.

I open the device as follows:
pcap = pcap_open(adapterName, 65536,  PCAP_OPENFLAG_PROMISCUOUS,  1000,  NULL,  NULL);

I then set the following filter:
"(ip and udp) and (udp[8] & 0xEF = 0x80)" // RTP packets
Using:
pcap_compile()
and
pcap_setfilter()

I then continually call
pcap_next_ex()
and memcpy the resulting data into a reused memory buffer which is passed up to java through JNI NIO Direct Buffers.

This all works splendidly well until 4+ hours of capture, at which point pcap_next_ex() starts continually returning timeouts, and then eventually just blocks altogether.

I am not setting pcap_setmintocopy().

If I monitor the memory usage of my java process, there does not appear to be a memory leak.

Any ideas? Presumably, winpcap should support long captures without issue? Anyone experience something similar?

Thanks,
Ty



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20130224/332e9408/attachment.html>