We also implemented something like this using a user-kernel shared ring
buffer and events for signalling activity. This was some time ago but I seem
to remember the performance we rather good.
Ross
On Mon, Jan 31, 2011 at 10:48 PM, David R. Cattley wrote:
> > (does anyone now how whireshark does it?)
>
> Yes, it uses WinPCAP which is a fine packet capture facility for which
> source code is readily available.
>
> http://www.winpcap.org/
>
> Good Luck,
> Dave Cattley
>
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>