Network Filtering Performance
PASSTHRU is not designed for maximum performance. PASSTHRU is designed to =
be easy to read, understand, and modify. There are certainly "tricks" you =
can use to get more performance out of PASSTHRU. But first make sure that =
that is the right thing to do.=20
On Windows Vista and later, WFP is significantly faster than any IM driver.=
Off the top of my head:
- A WFP callout only touches the packets you care about (e.g., if you only =
care about incoming TCP port 80, you'll only see those packets). On the ot=
her hand, an IM driver sits in the path of EVERY packet.
- NDIS 5.1 IM drivers use the legacy NDIS_PACKET datapath. This means NDIS=
has to convert its native NBLs to NDIS_PACKETs for the IM driver, then con=
vert the NDIS_PACKETs back to NBLs when the IM driver is done. WFP nativel=
y uses NBLs directly, so there's no conversion overhead.
- Because NDIS 5 IM drivers use the legacy NDIS_PACKET format, they can't t=
ake advantage of the scalability of NBLs: it's harder to manipulate many pa=
ckets at a time.=20
- If there are multiple IM drivers in the stack (more than 2, and Windows X=
P comes with 1 already), you may end up having to allocate a new packet for=
each receive indication. In contrast, you can have a large number of WFP =
callouts without needing to allocate extra packet bookkeeping on the datapa=
- We (Microsoft) stopped trying to improve NDIS 5 a decade ago. However, w=
e've relentlessly pursued performance improvements for WFP and NDIS 6.x. O=
ur internal performance benchmarks all use WFP and NDIS 6.x, and that's whe=
re we spend all our time. The operating system doesn't use NDIS 5.1 IM dri=
vers anymore, because the perf overhead would be so bad.
Additionally, WFP is significantly easier for you to write. That means tha=
t you'll spend less time debugging strange deadlocks, and you'll have more =
time to spend tuning your own performance (or more time to go home early ;-=
If you are targeting Windows XP, then you have no choice: WFP is not suppor=
ted on that platform, and you must use an NDIS 5.x IM driver or TDI.
From: email@example.com [mailto:firstname.lastname@example.org=
sr.com] On Behalf Of email@example.com
Sent: Tuesday, January 17, 2012 7:35 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Network Filtering Performance
I am looking for network filtering capabilities and I am unable to find per=
formance numbers of possible technologies. Did somebody tested it ?
I am looking for this :
- is MS Passthru sample for NDIS 5.1 fastest solution for NDIS 5.1 Intermed=
iate or it can be speeded up somehow ?
- how looks performance of NDIS 5.1 intermediate against Windows Filtering =
NTDEV is sponsored by OSR
For our schedule of WDF, WDM, debugging and other seminars visit:=20
To unsubscribe, visit the List Server section of OSR Online at http://www.o=