Ethereal-users: [Ethereal-users] Ethereal very slow when monitoring a spanned port

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Suhrstedt, Tom" <tsuhrstedt@xxxxxxxxxx>
Date: Mon, 7 May 2001 12:46:55 -0400
I downloaded the 0.8.17 and the latest WinPcap and successfully ran
Ethereal on Win2K machines to monitor the normal traffic on the network
port of a PC (with 256 Mbytes memory) with good performance, even with
real time display and scrolling. I was impressed.

However, when I try to span traffic from a Cisco 5505 switch port to the
PC's port, I get very slow performance for anything (including Ethereal)
on that PC, with extremely long times to move or resize a window or
refresh the display and Ethereal will sometimes just hang.  Even if I
disable real time display and scrolling and just do a capture things are
very slow, and it will take about ten minutes to load about 800 packets
into the display after the capture has been stopped. I got the same
behavior whether I used a laptop or a tower PC using different NIC
cards.

This happens even if I span the traffic from only one port, so it seems
like it has something to do with spanning and promiscutiy more that the
traffic volume.  I know this is beta software, but was hoping that
someone could confirm this behavior or point out the error of my ways. 

Many thanks.
---
Tom Suhrstedt