Home › Forums › Discussions › Support Portal › NtKernel filter best performance for reinjecting traffic › Re: Re: NtKernel filter best performance for reinjecting traffic
ReadPackets/SendPacketsToXXX were added to reduce number of user/kernel context switches and thus increase the performance.
The easiest approach would be processing packets one by one in one thread, however, if you use multiply threads for and still want to take an advantage of SendPacketsToXXX API calls I would keep an internal queue of packets for each network interface which are ready to send to driver (actually two queues, one for outgoing and one for incoming packets). Queue should be sent to driver on one of two events:
1) Queue size reached its “immediate sent” size
2) Timeout occurs
Size and timeout should be dynamic parameters adjusted depending on the amount of packets you get from the driver. E.g. the faster you read packets from the driver the less the timeout.