Driver Problems? Questions? Issues?
Put OSR's experience to work for you! Contact us for assistance with:
  • Creating the right design for your requirements
  • Reviewing your existing driver code
  • Analyzing driver reliability/performance issues
  • Custom training mixed with consulting and focused directly on your specific areas of interest/concern.
Check us out. OSR, the Windows driver experts.

Upcoming OSR Seminars:

Writing WDF Drivers I: Core Concepts, Nashua, NH 15-19 May, 2017
Writing WDF Drivers II: Advanced Implementation Tech., Nashua, NH 23-26 May, 2017
Kernel Debugging and Crash Analysis, Dulles, VA 26-30 June, 2017
Windows Internals & Software Driver Development, Nashua, NH 24-28 July, 2017


Go Back   OSR Online Lists > ntdev
Welcome, Guest
You must login to post to this list
  Message 1 of 3  
17 Jan 12 10:33
Radek Voltr
xxxxxx@xacti.com
Join Date: 17 Jan 2012
Posts To This List: 2
Network Filtering Performance

I am looking for network filtering capabilities and I am unable to find performance numbers of possible technologies. Did somebody tested it ? I am looking for this : - is MS Passthru sample for NDIS 5.1 fastest solution for NDIS 5.1 Intermediate or it can be speeded up somehow ? - how looks performance of NDIS 5.1 intermediate against Windows Filtering Platform ?
  Message 2 of 3  
17 Jan 12 13:37
Jeffrey Tippet [MSFT]
xxxxxx@microsoft.com
Join Date: 29 Mar 2010
Posts To This List: 404
Network Filtering Performance

PASSTHRU is not designed for maximum performance. PASSTHRU is designed to = be easy to read, understand, and modify. There are certainly "tricks" you = can use to get more performance out of PASSTHRU. But first make sure that = that is the right thing to do.=20 On Windows Vista and later, WFP is significantly faster than any IM driver.= Off the top of my head: - A WFP callout only touches the packets you care about (e.g., if you only = care about incoming TCP port 80, you'll only see those packets). On the ot= her hand, an IM driver sits in the path of EVERY packet. - NDIS 5.1 IM drivers use the legacy NDIS_PACKET datapath. This means NDIS= has to convert its native NBLs to NDIS_PACKETs for the IM driver, then con= vert the NDIS_PACKETs back to NBLs when the IM driver is done. WFP nativel= y uses NBLs directly, so there's no conversion overhead. - Because NDIS 5 IM drivers use the legacy NDIS_PACKET format, they can't t= ake advantage of the scalability of NBLs: it's harder to manipulate many pa= ckets at a time.=20 - If there are multiple IM drivers in the stack (more than 2, and Windows X= P comes with 1 already), you may end up having to allocate a new packet for= each receive indication. In contrast, you can have a large number of WFP = callouts without needing to allocate extra packet bookkeeping on the datapa= th. - We (Microsoft) stopped trying to improve NDIS 5 a decade ago. However, w= e've relentlessly pursued performance improvements for WFP and NDIS 6.x. O= ur internal performance benchmarks all use WFP and NDIS 6.x, and that's whe= re we spend all our time. The operating system doesn't use NDIS 5.1 IM dri= vers anymore, because the perf overhead would be so bad. Additionally, WFP is significantly easier for you to write. That means tha= t you'll spend less time debugging strange deadlocks, and you'll have more = time to spend tuning your own performance (or more time to go home early ;-= ) ). If you are targeting Windows XP, then you have no choice: WFP is not suppor= ted on that platform, and you must use an NDIS 5.x IM driver or TDI. -----Original Message----- From: xxxxx@lists.osr.com [mailto:bounce-489977-46572@lists.o= sr.com] On Behalf Of xxxxx@xacti.com Sent: Tuesday, January 17, 2012 7:35 AM To: Windows System Software Devs Interest List Subject: [ntdev] Network Filtering Performance I am looking for network filtering capabilities and I am unable to find per= formance numbers of possible technologies. Did somebody tested it ? I am looking for this : - is MS Passthru sample for NDIS 5.1 fastest solution for NDIS 5.1 Intermed= iate or it can be speeded up somehow ? - how looks performance of NDIS 5.1 intermediate against Windows Filtering = Platform ? --- NTDEV is sponsored by OSR For our schedule of WDF, WDM, debugging and other seminars visit:=20 http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.o= sronline.com/page.cfm?name=3DListServer
  Message 3 of 3  
17 Jan 12 16:44
David R. Cattley
xxxxxx@msn.com
Join Date: 09 Jul 2002
Posts To This List: 2102
Network Filtering Performance

> - is MS Passthru sample for NDIS 5.1 fastest solution for NDIS 5.1 Intermediate or it can be speeded up somehow ? Are you concerned about some specific aspect of the performance characteristics of PASSTHRU? In its NDIS5.1 (with packet stacking enabled) form, it is about as effecient as it can be in terms of 'doing nothing' given the nature of NDIS5. Comparing it to WFP an apples to oranges comparison. If you have the option of using WFP (or even an NDIS6 LWF driver) than you should not even look at PASSTHRU. If you have to target NT5 then you do not need to compare the solution to WFP since it is not a choice on NT5. If you have to target *both* platforms than seriously consider doing whatever you are doing in two separate driver implemenations. If the problem is inherently a 'layer 2' (Ethernet) problem, then an NDIS IM and NDIS LWF are appropriate. If the problem is inherently 'layer 3' (IP) then WFP on NT6 and, well, good luck on NT5. Again, the IM driver is a choice. With careful planning you can often build the 'core' of your processing with largely shared code that is agnostic with respect to how it gets access to the packet data. Good luck, Dave Cattley --
Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You must login to OSR Online AND be a member of the ntdev list to be able to post.

All times are GMT -5. The time now is 20:05.


Copyright ©2015, OSR Open Systems Resources, Inc.
Based on vBulletin Copyright ©2000 - 2005, Jelsoft Enterprises Ltd.
Modified under license