Winpcap code - Capture loses packets in loop

Question

I have a loop to capture packets with pcap_next_ex and in each iteraction I do a lot of functions calls according to process the packets. This stuff can be simulated by a Sleep() call in the loop. Then what happen then I call Sleep in a pcap_next_ex() loop?.

pcap_pkthdr* header = NULL;

UCHAR* content = NULL;

pcap = pcap_open(adapterName.c_str(), 65536, PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, NULL);

//Set to nonblock mode?

while (INT res = pcap_next_ex(pcap, &header, const_cast<const UCHAR**>(&content)) >= 0)
{
    if (res != FALSE)
    {
        if (content)
        { 
             //Here i do the stuff which I will simulate with a Sleep() call

             Sleep(200);
        }
    }
}

I have seen code which uses pcap_next_ex and save the packets in a vector to treat them later with another thread, this method reduces the time of the stuff notably but does not convince me a lot. Shall I use this method?.

I would like to use other winpcap functions which capture packets in "non blocking" mode and call an event for each packet which comes... What is the best method to not lost packets with winpcap?.

Any help will be appreciated. Regards.

Answer 1

WinPcap stores packets it captures into a ring buffer the size of which is limited. If the number of bytes of packets reach the ring buffer size, the old packets are discarded so that WinPcap can store new packets.

So, you should call pcap_next_ex as frequently as possible so that you can get as many packets as possible before they are discarded.

Calling pcap_next_ex in a dedicated thread and processing packets in another thread is a good practice because this way can call pcap_next_ex the most frequently.