Oops... I didn't see that you were the same user of the previous mail ;)
In general, if you want not to lose packets, you have 1. use a filter (the one used in pcap_compile, like "ip net 1.2.3") to capture ONLY those packets of interest 2. the code that processes packets at user level must be as fast as possible. In particular, it is not advisable to store the packets on HD, unless you strictly need it, because the HD can become the bottleneck. 3. limit the part of the packet brought to user: if you need only to look at some headers in the packet, you can simply capture the first 100 bytes or so, not the whole packet. GV ----- Original Message ----- From: "Selcuk Cevher" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Monday, April 29, 2002 8:39 AM Subject: [WinPcap-users] winpcap performance - 2 > hi.. > i am trying to develope a kind of sniffer program using Visual C++(MFC)and > under Windows 2000 advanced server platform ,which will examine ALL IP > packets on an Ethernet and record only those > packets or packet segments that meet very specific parameters,as my graduate > thesis.So i want to select the right tool to perform this.So,have you got > any suggestions to help me select the right tool(winpcap or something else)? > I need the fastest one possible.thanks... > > aksuvari > > > > _________________________________________________________________ > Join the world�s largest e-mail service with MSN Hotmail. > http://www.hotmail.com > >
