[Winpcap-users] winpcap capture speed

[Ben Greear]

On 06/27/2013 09:57 PM, Александр wrote:
> OK, i understand about UDP. But my transmitter is passive hardware UDP transmitter: transmitt speed corresponds to the speed of the outgoing UDP packets.
> I removed a router and connect transmitter directly to pc. The situation has not changed.
> What can help me in this situation? 150 mbit/s... 558 mbit/s.... If i need highest speed? 700-800? I provide discovering in only capturing process, not dumping.

Use Linux, and if writing to disk, use something fast like an SSD.

Thanks,
Ben

> --
> Alex
> 27.06.2013, 19:12, "Black, Michael (IS)" <Michael.Black2 at ngc.com>:
>> OK..you realize that UDP is frequently called "Unreliable Data Protocol".
>>
>> You will get collisions on the network and the packets will get lost unless you implement your own ack/nak method.  The faster you send the more likely it is.
>>
>> Lot's of D-Link gigabit switches...many of which are hardly high-speed devices so it could cause some problems too.
>>
>> I would first test a network crossover cable and see if the D-Link is your problem.
>>
>> Better yet is to use TCP but you really need a capture port on the switch do a fair comparison.
>>
>>
>> I tested IPerf on my home network (I work from home).
>> http://www.softpedia.com/progDownload/Iperf-Download-78352.html
>>
>>
>> Server:
>> iperf -s -u
>> Client:
>> iperf -c server -l 9000 -u 100M
>>
>> I lost one packet at 100Mbit
>> At 150Mbit I lost 4 packets.
>>
>> I'm running through an ASUS wireless router.
>>
>> If I run in tcp mode I get 558Mbits/sec
>>
>> You just can't push UDP very fast without losing packets.  Collision probability is directly related to bandwidth utilization.
>>
>>
>>
>> Michael D. Black
>> Senior Scientist
>> Analytics, Production and Services
>> Advanced GEOINT Systems
>> Northrop Grumman Information Systems
>>
>> ----------------------------------------------------------------------------------------------------------------------------------------------------------------
>> *From:* winpcap-users-bounces at winpcap.org <mailto:winpcap-users-bounces at winpcap.org> [winpcap-users-bounces at winpcap.org
>> <mailto:winpcap-users-bounces at winpcap.org>] on behalf of Александр [sitesv at yandex.ru <mailto:sitesv at yandex.ru>]
>> *Sent:* Thursday, June 27, 2013 9:33 AM
>> *To:* winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
>> *Subject:* EXT :Re: [Winpcap-users] winpcap capture speed
>> 1. I capturing UDP packets.
>> 2. Size = JumboFrame 9k.
>> 3. Yes, i'm sure.
>> 4. Realtek GbE (motherboard onboard)
>> 5. PC, Core i7, about 3GHz.
>> 6. Switch: D-Link Gigabit Switch.
>> -- Alex
>> 27.06.2013, 18:27, "Black, Michael (IS)" <Michael.Black2 at ngc.com <mailto:Michael.Black2 at ngc.com>>:
>>> Are you doing TCP or UDP?  UDP would be bad for this.
>>> What size packets are you generating?  Smaller packets have a lot more overhead.
>>> Are you sure your data generator is actually sending all packets?
>>> What kind of network card do you have?
>>> What kind of machine do you have (CPU/Mhz)?
>>> What kind of switch are you on?
>>>
>>> Michael D. Black
>>> Senior Scientist
>>> Analytics, Production and Services
>>> Advanced GEOINT Systems
>>> Northrop Grumman Information Systems
>>>
>>> ----------------------------------------------------------------------------------------------------------------------------------------------------------------
>>> *From:* winpcap-users-bounces at winpcap.org <mailto:winpcap-users-bounces at winpcap.org> [winpcap-users-bounces at winpcap.org
>>> <mailto:winpcap-users-bounces at winpcap.org>] on behalf of Александр [sitesv at yandex.ru <mailto:sitesv at yandex.ru>]
>>> *Sent:* Thursday, June 27, 2013 9:09 AM
>>> *To:* winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
>>> *Subject:* EXT :Re: [Winpcap-users] winpcap capture speed
>>> Today, i tested a speed of winpcap capturing by changing network card window size and transmitt speed.
>>> ~120 mbit/s = 0 errors (4M window size)
>>> ~180 mbit/s = (1-5 errors on 2000000 packets) (32M window size)....
>>> So... WinPcap isn't suitable for high speed capturing.
>>> --
>>> Alex
>>> 26.06.2013, 20:55, "Black, Michael (IS)" <Michael.Black2 at ngc.com <mailto:Michael.Black2 at ngc.com>>:
>>>>
>>>> You need to multi-thread your code.
>>>>
>>>> Not that it is guaranteed but you need to get the packets out of the queue as fast as possible and put them in your own queue.
>>>>
>>>> Of course, you can then end up with an ever-growing queue if your code can't keep up.
>>>>
>>>> If all you do is count packets and NOTHING else does it behave?
>>>>
>>>> What kind of network card do you have?
>>>>
>>>> Michael D. Black
>>>> Senior Scientist
>>>> Analytics, Production and Services
>>>> Advanced GEOINT Systems
>>>> Northrop Grumman Information Systems
>>>>
>>>> ________________________________________
>>>> From: winpcap-users-bounces at winpcap.org <mailto:winpcap-users-bounces at winpcap.org> [winpcap-users-bounces at winpcap.org
>>>> <mailto:winpcap-users-bounces at winpcap.org>] on behalf of A.L. Kuramshin [alimjankuramshin at gmail.com <mailto:alimjankuramshin at gmail.com>]
>>>> Sent: Wednesday, June 26, 2013 11:48 AM
>>>> To: winpcap-users at winpcap.org <mailto:winpcap-users at winpcap.org>
>>>> Subject: EXT :Re: [Winpcap-users] winpcap capture speed
>>>>
>>>> As for me, it would not help. Packets loss will be delayed a bit, that's it. It will begin for example after 1 million packets or 2 or so, a bit later. Just
>>>> thoughts.. :)
>>>> _______________________________________________
>>>> Winpcap-users mailing list
>>>> Winpcap-users at winpcap.org <mailto:Winpcap-users at winpcap.org>
>>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>> _______________________________________________
>>>> Winpcap-users mailing list
>>>> Winpcap-users at winpcap.org <mailto:Winpcap-users at winpcap.org>
>>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>>
>>> ,
>>>
>>> _______________________________________________
>>> Winpcap-users mailing list
>>> Winpcap-users at winpcap.org <mailto:Winpcap-users at winpcap.org>
>>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>>
>> ,
>>
>> _______________________________________________
>> Winpcap-users mailing list
>> Winpcap-users at winpcap.org <mailto:Winpcap-users at winpcap.org>
>> https://www.winpcap.org/mailman/listinfo/winpcap-users
>>
>
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>


-- 
Ben Greear <greearb at candelatech.com>
Candela Technologies Inc  http://www.candelatech.com