NPCAP 1.60 high CPU usage with pcap filter that does not pass anything (Win10)

[Vladimir Soldatov <solardatov () gmail com>]

Hi guys,

I've a setup (Win10, Intel X520, NPCAP 1.60) with relatively high traffic
around 700 Mbit/s and I am trying to test the following cases:
1. Capture everything with empty pcap filter and just print stats with some
period calculating captured data size
2. Capture nothing with an intentionally created filter that does not match
the received traffic at all.
3. Capture some subset of traffic like 10%.

In all the cases, CPU usage increased up to 35% percent (3-4% when my test
app is not running). Is that expected even with case #1 when everything is
dropped by the filter and we pass nothing to our user mode app?

And one more question, are those cases equal from the NPCAP performance
perspective?
1. Capture 700 Mbit/s from single interface
2. Capture 700 Mbit/s in overall from two interfaces (like 350 Mbit/s on
each one)

I got a feeling that case #1 works better. Am I wrong?

_______________________________________________
Sent through the dev mailing list
https://nmap.org/mailman/listinfo/dev
Archived at https://seclists.org/nmap-dev/