TrafMeter Architecture

How does TrafMeter capture the packets from network ?

TrafMeter uses the free WinPcap driver as the packet capture engine. WinPcap includes a kernel-level packet filter, a low-level dynamic link library (packet.dll), and a high-level and system-independent library (wpcap.dll). The packet filter is a device driver that adds to Windows 95, 98, ME, NT, 2000 and XP the ability to capture and send raw data from a network card, with the possibility to filter and store in a buffer the captured packets.

The Filterset

The filterset is a main unit of TrafMeter. It consists of the preliminary filter, the filters to count custom IP packets, settings for making reports of a traffic usage and settings for a drawing of a graphic chart. The filterset can be saved in a file and loaded after TrafMeter startup. Due to the filterset isn't bound to a specific network adapter, you can share the filterset between computers in your network.

The Filters to count the traffic

Every filter contains own rule subset (up to 50 rules) making possible to count only useful traffic. In additional, it has an independent traffic collector, 64-bit sent bytes counter and 64-bit received bytes counter. The traffic counters will be updated if captured packet satisfies at least one rule listed in the filter. The number of the filters in TrafMeter is unlimited however a very more filters (>200) can decrease a system performance and can complicate a filters management.

The Preliminary Filter

The Preliminary Filter can block packets before they will be passed through all TrafMeter filters. It can be used to prevent a counting of useless traffic and to simplify a creating of rules in the filters. The Preliminary Filter has no counters. The Preliminary Filter is very effective when the total number of rules in all filters is more than the total number of rules in the Preliminary Filter.