●can mix various client technology (Intel or Motorola processor assembly of personal computers, computer networks, information kiosks, etc。) and public data sharing。 In addition, you can change the technology at any layer and other layers  only a small influence on the system module。

●able to handle close to the data source to be addressed to improve response time and reduce network traffic。

●accept it to allow and encourage open systems standards。

For database  development, the  use  of  a multi-layered  client  /  server database

architecture development is the most meaningful of the database will be easy to develop and maintain database module to the end-user and that the contents of the database information system module separated。 That routine can be used as PowerBuilder, Java, and Visual Basic language to provide this easy-to-use graphical user interface。 Through middleware that routine interaction between layers can be passed to access routine, the routine visit to the necessary data and analysis of these data in order to form the required information。 As a database developers and programmers, you can in this three-tier level of any of the work, developing the necessary software。

WinPcap kernel buffer is larger (default 1MB) than BPF one。 A small buffer penalizes the capturing process especially in case the application is not able to read as fast as the driver captures for a limited time interval。 Such situation is common when data has to be transferred to disk or when the network has bursty traffic。 Vice versa, user buffer is smaller and its default value is 256KB。 Both kernel and user buffer can be changed at runtime2。

The size of the user buffer is very important because it determines the maximum amount of data that can be copied from kernel space to user space within a single system call。 On the other hand, we noticed that also the minimum amount of data that can be copied in a single call is extremely important。 In presence of a large value for this variable, the kernel waits for the arrival of several packets before copying the data to the user。 This guarantees a low number of system calls, i。e。 low processor usage, which is a good setting for applications like sniffers。 On the other hand, a small value means that the kernel will copy the packets as soon as the application is ready to receive them。 This is excellent for real time applications (like, for example, an ARP redirector) that need the better responsiveness from the kernel。 The great part of the existing capture drivers has a static behavior that privileges one of the two aspects。 On the other hand, NPF is completely configurable and it allows users to choose between either best efficiency or best responsiveness (or any intermediate behavior)。 WinPcap includes a couple of system calls that can be used to set both the timeout after which a read expires and the minimum amount of data that can be transferred to the application。 Packets are copied either when the minimum amount of data is available or the read timeout has expired。 By default, the timeout is 1 second and the  minimum

amount of data is 16K。 This capability is often called “delayed write”3。

In general memory copies have to be kept the lowest because of their overhead。 WinPcap has the same copy overhead of the original libpcap/BPF and packets are copied two times (from network driver to the kernel, then to user space)。 Moreover the filtering is performed when the packet is still into the network driver’ s memory, thus avoiding any copy of non conformant packets in a similar way as the BSD bpf_tap() function does。

Tests confirm the excellent performance of WinPcap。 The packet generation process, even in presence of a strange behavior (maximum number of packets per second is reached with 88-bytes packets) is highly optimized and it is quite easy to reach the maximum load allowed by a Fast Ethernet LAN。 The capturing process also has  an  excellent  implementation  and  it  outperforms  the  original  BPF  /     libpcap