can u tell me what’s the meaning for “500 packets”
WinpkFilter driver preallocates 500 buffers for packets (to avoid overhead from allocate/release operations).
in what situation,we need modi the value?
User mode WinpkFilter application usually is not the only application running on the system and it is possible that it won’t get processor time (to read packets from driver) during some time interval. During this time interval packets are stored in the driver preallocated buffers. Once application gets processor time it can read packets from the driver and process. If your application can be prevented from execution for large time intervals but still gets enough processor time to read and filter packets on the high speed network then you may need to increase the amount of preallocated packet buffers.
An example, real network throughput for 100 Mbit network is about 10 megabytes per second. The maximum size of the Ethernet frame is 1514 bytes. The simple calculation gives you approximately 7000 packet per second rate on 100 Mbit network. So if WinpkFilter application is prevented from execution for less than 500/7000 ~ 0.07sec time interval you won’t notice any packet loss.