Skip to content

Portability notes for Winpcap

Robert David Graham edited this page Aug 22, 2013 · 1 revision

WinPcap is the libpcap compatible library for Windows. It's normal mode is slow, but it has a "send queue" feature that speeds things up about 10x. Some numbers for my hardware:

  • 30,000 pps transmit: WinPcap normal
  • 300,000 pps transmit: WinPcap with send queue
  • 3,000,000 pps transmit: Linux kernel
  • 30,000,000 pps transmit: native driver (e.g. PF_RING)

Masscan supports all these modes. On Windows, use the --sendq option to enable the feature (and something like --rate 1000000), and watch the scan go 10 times faster.

The trick with send queue is that you fill up the buffer with packets (without transmitting them) until the buffer is full, then you transmit the buffer. If you haven't filled the buffer, you can flush it prematurely.