[Winpcap-users] winpcap capture speed

[Black, Michael (IS)]

OK..you realize that UDP is frequently called "Unreliable Data Protocol".

You will get collisions on the network and the packets will get lost unless you implement your own ack/nak method.  The faster you send the more likely it is.

Lot's of D-Link gigabit switches...many of which are hardly high-speed devices so it could cause some problems too.

I would first test a network crossover cable and see if the D-Link is your problem.

Better yet is to use TCP but you really need a capture port on the switch do a fair comparison.


I tested IPerf on my home network (I work from home).
http://www.softpedia.com/progDownload/Iperf-Download-78352.html


Server:
iperf -s -u
Client:
iperf -c server -l 9000 -u 100M

I lost one packet at 100Mbit
At 150Mbit I lost 4 packets.

I'm running through an ASUS wireless router.

If I run in tcp mode I get 558Mbits/sec

You just can't push UDP very fast without losing packets.  Collision probability is directly related to bandwidth utilization.




Michael D. Black
Senior Scientist
Analytics, Production and Services
Advanced GEOINT Systems
Northrop Grumman Information Systems

________________________________
From: winpcap-users-bounces at winpcap.org [winpcap-users-bounces at winpcap.org] on behalf of Александр [sitesv at yandex.ru]
Sent: Thursday, June 27, 2013 9:33 AM
To: winpcap-users at winpcap.org
Subject: EXT :Re: [Winpcap-users] winpcap capture speed

1. I capturing UDP packets.
2. Size = JumboFrame 9k.
3. Yes, i'm sure.
4. Realtek GbE (motherboard onboard)
5. PC, Core i7, about 3GHz.
6. Switch: D-Link Gigabit Switch.

-- Alex

27.06.2013, 18:27, "Black, Michael (IS)" <Michael.Black2 at ngc.com>:
Are you doing TCP or UDP?  UDP would be bad for this.
What size packets are you generating?  Smaller packets have a lot more overhead.
Are you sure your data generator is actually sending all packets?
What kind of network card do you have?
What kind of machine do you have (CPU/Mhz)?
What kind of switch are you on?


Michael D. Black
Senior Scientist
Analytics, Production and Services
Advanced GEOINT Systems
Northrop Grumman Information Systems

________________________________
From: winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org> [winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org>] on behalf of Александр [sitesv at yandex.ru<mailto:sitesv at yandex.ru>]
Sent: Thursday, June 27, 2013 9:09 AM
To: winpcap-users at winpcap.org<mailto:winpcap-users at winpcap.org>
Subject: EXT :Re: [Winpcap-users] winpcap capture speed

Today, i tested a speed of winpcap capturing by changing network card window size and transmitt speed.
~120 mbit/s = 0 errors (4M window size)
~180 mbit/s = (1-5 errors on 2000000 packets) (32M window size)....
So... WinPcap isn't suitable for high speed capturing.

--
Alex


26.06.2013, 20:55, "Black, Michael (IS)" <Michael.Black2 at ngc.com<mailto:Michael.Black2 at ngc.com>>:

You need to multi-thread your code.

Not that it is guaranteed but you need to get the packets out of the queue as fast as possible and put them in your own queue.

Of course, you can then end up with an ever-growing queue if your code can't keep up.

If all you do is count packets and NOTHING else does it behave?

What kind of network card do you have?

Michael D. Black
Senior Scientist
Analytics, Production and Services
Advanced GEOINT Systems
Northrop Grumman Information Systems

________________________________________
From: winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org> [winpcap-users-bounces at winpcap.org<mailto:winpcap-users-bounces at winpcap.org>] on behalf of A.L. Kuramshin [alimjankuramshin at gmail.com<mailto:alimjankuramshin at gmail.com>]
Sent: Wednesday, June 26, 2013 11:48 AM
To: winpcap-users at winpcap.org<mailto:winpcap-users at winpcap.org>
Subject: EXT :Re: [Winpcap-users] winpcap capture speed

As for me, it would not help. Packets loss will be delayed a bit, that's it. It will begin for example after 1 million packets or 2 or so, a bit later. Just thoughts.. :)
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org<mailto:Winpcap-users at winpcap.org>
https://www.winpcap.org/mailman/listinfo/winpcap-users
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org<mailto:Winpcap-users at winpcap.org>
https://www.winpcap.org/mailman/listinfo/winpcap-users

,

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org<mailto:Winpcap-users at winpcap.org>
https://www.winpcap.org/mailman/listinfo/winpcap-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.winpcap.org/pipermail/winpcap-users/attachments/20130627/49ddb485/attachment-0001.html>