"Patrick Klos" <pklos@osmium.mv.net> wrote in message
news:dvpftr$20vr$1@pyrite.mv.net...
> In article <1220566nfec0jb3@news.supernews.com>,
> Atlas <atlaspeak@my-deja.com> wrote:
>>Wondering if there's any "network" overhead leaving WinPcap installed even
>>when not analyzing traffic.
>
> Not sure what you mean by "network overhead"? If WinPcap is idle, there
> won't be any network overhead since there is no additional network traffic
> generated by WinPcap or the app that loaded it. In general, traffic
> analyzers are totally passive and don't create/send packets.
>
Ignoring packet sniffing techniques, I imagine that WinPcap sits below
tcpip.sys (Windows XP) and "grabs" packets before sending them through the
normal flow. This process will happen even if the parent app isn't
requesting data. If this is the case a CPU cost (negligible?) is introduced.
Or am I Wrong?


Thanks!