on the other hand,Smile if my net traffice reach on 7mbps,can cause lose packet?
You loose packets ONLY if your application does not get processor time for some relatively large time interval.
because u had said:my app work in usermode. i want t deal with every packet, but it is still will be done in usermode not in the ring0.
please tell me System efficiency can Affected much more?
Of course Ring0 packet processing is more effective than Ring3 one, however most of the modern systems are powerful enough to afford packet processing in user mode even on high speed links.
by the way,when i use pkfilter, i found you alloc 1534 bytes for everypacket,why not 1514?
If you mean INTERMEDIATE_BUFFER structure then in addition to raw Ethernet frame it us used to keep some extra information about the packet (NDIS flags, direction and etc…)