LHMON: Different data size in Send and Receive

[vhochstein]

Hi,

and another one…

How might it happen that a send Packet has another data size as the corresponding receive packet?

—
Volker

[Vadim Smirnov]

Localhost Monitor works at TDI level, so there are no actual packets there, but blocks of data instead. Some blocks can be splitted or merged, probably this is what you’ve expirienced…

[vhochstein]

Localhost Monitor works at TDI level, so there are no actual packets there, but blocks of data instead. Some blocks can be splitted or merged, probably this is what you’ve expirienced…

Does that splitting or merging mix up also incomming and outgoing streams?

If your answer is now, than I m definetly missing some data, cause the stream is sendout to another process and received by that process. Unfortunetly, 1606 Bytes are send by Source Process and 3760 Bytes are received by Destination Process. All other “stream packets” in that time slot are OK, so send and received bytes are matching.

—
Volker

[Vadim Smirnov]

There is also a chance that you system is heavily loaded and user mode application can’t read driver log fast enough. In this case driver’s internal packet log is overloaded and it may drop some data blocks.

[Author]

Posts