Re: Re: NtKernel filter best performance for reinjecting traffic

Home Forums Discussions Support Portal NtKernel filter best performance for reinjecting traffic Re: Re: NtKernel filter best performance for reinjecting traffic

#7153

Vadim Smirnov
Moderator

ReadPackets/SendPacketsToXXX were added to reduce number of user/kernel context switches and thus increase the performance.

The easiest approach would be processing packets one by one in one thread, however, if you use multiply threads for and still want to take an advantage of SendPacketsToXXX API calls I would keep an internal queue of packets for each network interface which are ready to send to driver (actually two queues, one for outgoing and one for incoming packets). Queue should be sent to driver on one of two events:
1) Queue size reached its “immediate sent” size
2) Timeout occurs

Size and timeout should be dynamic parameters adjusted depending on the amount of packets you get from the driver. E.g. the faster you read packets from the driver the less the timeout.