I downloaded the 0.8.17 and the latest WinPcap and successfully ran
Ethereal on Win2K machines to monitor the normal traffic on the network
port of a PC (with 256 Mbytes memory) with good performance, even with
real time display and scrolling. I was impressed.
However, when I try to span traffic from a Cisco 5505 switch port to the
PC's port, I get very slow performance for anything (including Ethereal)
on that PC, with extremely long times to move or resize a window or
refresh the display and Ethereal will sometimes just hang. Even if I
disable real time display and scrolling and just do a capture things are
very slow, and it will take about ten minutes to load about 800 packets
into the display after the capture has been stopped. I got the same
behavior whether I used a laptop or a tower PC using different NIC
cards.
This happens even if I span the traffic from only one port, so it seems
like it has something to do with spanning and promiscutiy more that the
traffic volume. I know this is beta software, but was hoping that
someone could confirm this behavior or point out the error of my ways.
Many thanks.
---
Tom Suhrstedt