And how exactly am I supposed to configure an
interface to capture the traffic in just one
direction, e.g. in ethernet case? Is there something
to be done in software (like tcpdump modification) or
in hardware (like something to do with ethernet
cable)?
--- Ronnie Sahlberg <ronnie_sahlberg@xxxxxxxxxxxxxx>
wrote:
> Yes, capturing a 155MB ATM link will require two
> cards capturing 155Mbit/s
> each, one for
> each direction, for a total of 310Mbit/s. ATM is
> always full duplex, both
> pure-ATM as well as ATM over SDH/SoNET.
>
>
> This is only if you use pure-ATM though.
> I dont know whether pure-ATM is very common today or
> if what you want to
> capture today is really
> just ATM ocer STM-1.
>
> Though a normal STM-1 link is 155Mbit/s, a lot of
> bandwidth is lost to
> regenerator, multiplexor and vc-4 layer which leaves
> only
> 126Mbit in each direction for ATM traffic.
>
>
> It would still need two cards to capture the data in
> both directions
> since both pure-ATM as well as ATM over SDH (or
> SoNET depending on your
> location)
> are both full duplex always.
> It would only mean that the available throughput
> would be slightly less and
> the line interfaces would be
> alot more expensive.
>
> ----- Original Message -----
> From: "Enoch Root"
> Sent: Thursday, May 01, 2003 10:27 PM
> Subject: [Ethereal-users] full duplex clarification
> and performance
> consideration
>
>
> > Hi there;
> >
> > While searching archives for performance advices I
> > came accross a mail authored by Ronnie Sahlberg
> >
>
(http://marc.theaimsgroup.com/?l=ethereal-users&m=104681304109441&w=2)
> > in which he points out that to capture traffic on
> a
> > 100baseT full-duplex link one should use two cards
> for
> > capturing each direction of the flow. Andreas
> Sikkema
> > asked
> >
>
(http://marc.theaimsgroup.com/?l=ethereal-users&m=104685253408455&w=2)
> > how does one configure an interface to capture
> traffic
> > only in one direction but I couldn't find the
> answer
> > in the archives. Could someone answer this
> question?
> >
> > I'm planning to build a sniffer for a 155Mbit/s
> ATM
> > link, assuming a fully saturated link, does that
> mean
> > 310Mbit/s full-duplex traffic, hence, roughly
> 40MB/s
> > disk write?
> >
> > I'd be thankful if people with similar experiences
> > could share their findings, the performance issue
> > definitely deserves to be FAQ entry.
> >
> > Thanks.
> >
> >
> > __________________________________
> > Do you Yahoo!?
> > The New Yahoo! Search - Faster. Easier. Bingo.
> > http://search.yahoo.com
> >
> > _______________________________________________
> > Ethereal-users mailing list
> > Ethereal-users@xxxxxxxxxxxx
> >
>
http://www.ethereal.com/mailman/listinfo/ethereal-users
>
__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com