From: Fei Zhang on
I revised the inspect sample driver, add the filter to capture all inbound
packets, set action to FWP_ACTION_BLOCK if the injection state is neither
FWPS_PACKET_INJECTED_BY_SELF nor FWPS_PACKET_PREVIOUSLY_INJECTED_BY_SELF,
and reinject these packets from the InspectWorker thread. Then I use chariot
to test the tcp performance with 1 rx pair and 1 tx pair.
After my inspect driver is loaded, the rx+tx performance will be about
only 450Mbps, and the cpu usage is about 70%. If my driver is unloaded, the
rx+tx performance will be about 1.45Gbps, and the cpu usage is ranging from
10%-60%, the average is about only 35%.
2cores cpu: Intel(R) Pentium(R) 4 cpu 3.00GHz, 3.02GHz
RAM 1G
It seems that the cpu usage is too high after my driver is loaded. Has
anybody got high performance with filtering all inbound packets?
Thanks a lot in advance for any suggestions.
Fei Zhang



__________ Information from ESET NOD32 Antivirus, version of virus signature database 5270 (20100711) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com