CODEWITHSUNDEEP
windowswindows-xpudpwindbgwinsock
Kjell Gunnar
Kjell Gunnar

Reputation: 3067

How to Monitor the UDP Buffers in Windows XP

I’m trying to optimize the communication in a large system which is based on UDP. By optimizing, I mean to minimize the loss of packets. (Yes I know the inherent limitations of UDP, don’t suggest another protocol) We have several .exe each with several threads, and use

setsockopt with SO_SNDBUF  & SO_RCVBUF to increase to bufers.

We have experienced that setting very large buffer for many sockets degrade the overall performance (more packet loss) But how to monitor the effect of these increased buffer sizes? . Especially on the receive side, I would like to see if any ports gets messages is discarded due to lack of buffer.

Please suggest how this can be done, (Windbg in user or kernel mode, special programs, witting something self)

EDIT: @EdChum: I have already used WireShark, and yes its painful to correlate the packets on the wire with the packets received by the application. And I have seen several occasions where the packet is on the wire, (captured by Wireshark) but not received by the application. Those packets lost are usually a small packet to a multicast destination, which is sent with a very little time gap after a big unicast packet. The receiver of the unicast looses the multicast, but other receives it.

My suspicion is that XP sometimes suffer from some buffer starvation somewhere in the NDIS or IP layers and therefore silently drops packets. If there is a counter somewhere I could get this confirmed.

Upvotes: 3

Views: 1408

Answers (1)

EdChum
EdChum

Reputation: 394071

Not sure how to do this using WinDbg but I would use either NetMon or WireShark to monitor the packets and see if any are being discarded, it will be painful depending on how easy it is to reproduce and you will need to learn how to filter the packets so that the display shows what you are interested in but the help for both those apps are very useful.

You have to listen to a physical socket and not the loopback address in order to monitor the packets.

Upvotes: 1

Related Questions