SharpPCap missing packets - wireshark

Question

I'm using SharpPCap to collect IEC61850-9-2LE Sampled Values over Ethernet.
IEC61850-9-2LE Sampled Values consists of several streams, each one sending 4000 packets per second, where the avg packet size is 125 bytes.
Using SharpPCap I'm trying to collect 3 of those streams (3x4000 packets per second - 125bytes each).
In the following code I set up the Network Interface Card.
if (nicToUse != null)
{
try
{
nicToUse.OnPacketArrival -= OnPackectArrivalLive;
nicToUse.OnPacketArrival += OnPackectArrivalLive;
try
{
if (nicToUse.Started)
nicToUse.StopCapture();
if (nicToUse.Opened)
nicToUse.Close();
}
catch (Exception)
{
//no handling, just do it.
}
nicToUse.Open(OpenFlags.Promiscuous|OpenFlags.MaxResponsiveness,10);
var kernelBufferAssigned = false;
uint kernelBufferSize = 200;
while (!kernelBufferAssigned)
{
try
{
nicToUse.KernelBufferSize = kernelBufferSize * 1024 * 1024;
kernelBufferAssigned = true;
}
catch (Exception)
{
kernelBufferSize--;
}
}
nicToUse.Filter = "(ether[0:4] = 0x010CCD04)";
watchdog.Enabled = true;
counter = 0;
nicToUse.StartCapture();
}
catch (Exception ex)
{
throw new Exception(Resources.SharpPCapPacketsProducer_Start_Error_while_starting_online_capture_, ex);
}
}
This is the OnPacketArrival event handler:
private void OnPackectArrivalLive(object sender, CaptureEventArgs e)
{
try
{
counter++;
circularBuffer[circularBufferIndex] = e.Packet;
circularBufferIndex++;
if (circularBufferIndex > circularBufferSize - 1)
circularBufferIndex = 0;
}
catch (Exception)
{
}
}
When the capturing is over (user stops it), the captured packets are decoded and since they hold a sequential counter I've discovered some samples are missing.
Connecting the same source to another PC running Wireshark, those samples are not missing.
Any idea ?

Answer 1

What version of SharpPcap are you using? There have been some pretty big performance improvements due to overhead reduction in the 3.x and 4.x series.
Your example seems to be wrapping the circular buffer around at the tail. What type is circularBuffer? How are you sure that you are processing the packets before your buffer has filled up?
Have you looked at this example, from the SharpPcap source distribution, that shows one technique for doing background packet processing?
QueueingPacketsForBackgroundProcessing/Main.cs