View unanswered posts | View active topics It is currently Wed Oct 16, 2019 4:22 am



Post new topic Reply to topic  [ 2 posts ] 
 What is the reason of packet lost in real time mode? 
Author Message

Joined: Sat Oct 10, 2009 10:04 am
Posts: 38
Reply with quote
Post What is the reason of packet lost in real time mode?
Hi,

In rltm.c, here has been defined callback function for capturing packets:
Code:
pcap_loop(cap, -1, (pcap_handler)&RltmDissector, (u_char*)&ref);

In RlrmDissector function, is called ProtDissec function to start decoding:
Code:
ProtDissec(pcap_prot_id, pkt);

Which one is the reason of packet lost in real time mode?

1.libpcap after returning RltmDissector function, gets it next packet. So if next packet arrives before returning RltmDissector function, new packet will miss.

2. When ProDissec is processing a packet, if next packet arrives, processing previous packet will ignore because of recalling RltmDissector.


Wed Dec 29, 2010 9:18 am
Profile
Site Admin

Joined: Wed Sep 16, 2009 10:09 pm
Posts: 394
Reply with quote
Post Re: What is the reason of packet lost in real time mode?
The real-time functionalities (capture modules) are two in Xplico:
- cli realtime: rtml
- XI realtime: rtml_pol
each of the two suffers from the first problem you mentioned:
Quote:
libpcap after returning RltmDissector function, gets it next packet. So if next packet arrives before returning RltmDissector function, new packet will miss.

the idea is just the dynamic is a bit more specific.
The rtml_pol has another good reason, that is the code:
Code:
        while (DispatchPeiPending() > DISP_PEI_MAX_QUEUE) {
            to.tv_sec = 2;
            to.tv_nsec = 1;
            /* wait some time */
            while (nanosleep(&to, &to) != 0)
                ;
            ReportSplash();
        }

This code slows down the acquisition and thus increases the probable loss of packets.
But this code is important because it serves to control the size of memory used by Xplico . The code scales the input with the output data (this is great with the pcap file is not with the real time).
There are other softwares that have been developed to capture network data and operate very well. Xplico is designed to decode, not to capture the data.

Ciao.
Gianluca


Wed Dec 29, 2010 7:22 pm
Profile WWW
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 2 posts ] 


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Designed by Vjacheslav Trushkin for Free Forums/DivisionCore.