This project is read-only.

Play PCAP file with high speed takes more time than the file duration

Nov 7, 2014 at 8:30 AM
Edited Nov 7, 2014 at 8:33 AM
I have PCAP file with average rate of 30mb and about 16,000 packets per seconds, and ~900,000 packets.
The duration of this file is 50 seconds and if i send all the packets inside this file using the example Here in the tutorial it take about 110-120 seconds and this is without any delay between the packets.
The CPU usage is not so high, up to 10%. (i7)
Is it possible to play this file faster ? or this is the maximum that this DLL's can do ?
Coordinator
Nov 7, 2014 at 10:22 AM
Hi gshhar,

It's hard for me to guess what is the bottleneck of your application.
It could be CPU, synchronization, RAM, disk read, network device, WinPcap driver etc.

I think you should test it some more to find out what is the bottleneck.

Boaz.
Nov 7, 2014 at 1:32 PM
Edited Nov 7, 2014 at 3:58 PM
i have the latest WinPcap version, i7 CPU, SSD hard drive, Giga ethernet adapter and 16G of ram.
i checked this on several machines and on this machine this is the best time.
any other suggestions ?

Could be that 16,000 packets per seconds is too much or you believe that this is not the problem?

BTW i checked only how much time is take to only read the packets without sending and this take less than a second.
Coordinator
Nov 8, 2014 at 8:09 AM
Hi gshhar,

Can you show the code you use to do that?

Boaz.
Nov 8, 2014 at 10:56 AM
        private static PacketCommunicator communicator;
        private static string file = @"C:\cap.pcap";

        static void Main(string[] args)
        {
            // Retrieve the device list from the local machine
            IList<LivePacketDevice> allDevices = LivePacketDevice.AllLocalMachine;

            // Take the selected adapter
            PacketDevice selectedDevice = allDevices[0];

            //// Create the offline device
            OfflinePacketDevice selectedInputDevice = new OfflinePacketDevice(file);

            // Open the capture file
            DateTime start = DateTime.Now;
            using (PacketCommunicator inputCommunicator = selectedInputDevice.Open(65536, PacketDeviceOpenAttributes.Promiscuous, 1000))
            {
                using (communicator = selectedDevice.Open(100, PacketDeviceOpenAttributes.Promiscuous, 1000))
                {
                    inputCommunicator.ReceivePackets(0, DispatcherHandler);
                }                
            }

            DateTime finish = DateTime.Now;
            Console.WriteLine(finish.Subtract(start).TotalSeconds);
            Console.ReadLine();
        }

        private static void DispatcherHandler(Packet packet)
        {
            if (packet != null)
                communicator.SendPacket(packet);
        }
    }
Nov 10, 2014 at 8:52 PM
I have never thought to use C# for sending packets and I think I'll never start (I just don't believe in that anymore), although I remember that I've tried that and ended up with very similar results (something around 30Mb on packets 300B and smaller packets in general sending small packets is tough for the system).

I've been doing a little research on this one. Have you tried tweaking OS a little bit? Few ideas are here, but I didn't try any of them http://www.speedguide.net/articles/windows-7-vista-2008-tweaks-2574

OS may be the limitation here although if you're running it in VM, it might get slower there as well. Check also for hints with your Virtual Appliance if any.

I admire PcapDotNet and I use it only for generating packets and as for sending, I prefer external sending tools which can be simply manage from .Net with somewhat guaranteed bandwidth (if all your HW components are at sync, you'll get almost 95% of your bandwidth).
Nov 11, 2014 at 10:22 AM
Why not using .Net for send packets ?
I didn't try tweaking OS, what this doing ?
Nov 11, 2014 at 11:01 AM
IMO I think that it is just too slow. That's all. Whenever I have to send packets at highest speed I use linux, usually CentOS, if I need higher than 1Gbps I would recommend some HW solution.

Well in general there are number of things which OS has to define for interface as well as some HW configuration which you can simply adjust. I would recommend reading through them carefully, you don't have to do all of them and even few of them would not make sense at all in your case.
Coordinator
Nov 14, 2014 at 9:36 AM
Hi gshhar,

It could be the OS that slows you down.
You can try and send random packets without Pcap.Net and see what the limit is.

I hope this helps,

Boaz.