Packets processing code in the OnPacketReceive event handler must be as fast as possible because
if the packets processing performance is low, and the network traffic is high, you run the risk of
losing some packets.
Please use statistics to make sure that your application does not lose any packets.
For example, when you use a BPF filter, and if your application is in time to process all packets,
then the value returned by Get_ProcessCount is equal to
the Get_AcceptCount one.
If you do not use a filter, you should compare
Get_ProcessCount and
Get_RecvCount returned values. In this way you can check,
whether your application is able to process the whole network traffic received by the Packet Sniffer
SDK internal driver from the system.
When the network traffic is very high, it would be very appropriate to create a packets processing
queue in your application, using a separate thread, and just enqueue the received packets in the
OnPacketReceive event handler, and to notify this queue about the receiving of a new packet (see
HNQueue).
Also, you should take into account that OnPacketReceive event handler is called in the context of a
thread, created by Packet Sniffer SDK library.
We strongly recommend you to do nothing related to the data displaying in this event handler. If
the traffic is high, such actions may lead to the hanging of the application and packets loss.
OnPacketReceive event handler example:
procedure TForm1.HNAdapterOnPacketReceive(Sender: TObject;
ThParam, hPacket, pPacketData: Pointer; IncPacketSize: DWORD);
var
pEth: PETHERNET_HEADER;
EthType: Word;
pArp: PARP_HEADER;
begin
HNPacket1.Handle := hPacket;
if (HNPacket1.MediumType <> atEthernet) then Exit;
pEth := PETHERNET_HEADER(pPacketData);
EthType := htons(pEth^.EthType);
...
if(EthType = ETHERTYPE_ARP) then
begin
pArp := PARP_HEADER(@PByteArray(pPacketData)^[sizeof(ETHERNET_HEADER)]);
MoveMemory(@DestMacAddr[0],@pArp^.Sndr_Hw_Addr[0],6);
SetEvent(RecvArpPacket);
Exit;
end;
...
end;