[Joe Acquisto <joea@xxxxxxxxxxxx>]

Different animals, no?  

Not sure what you mean by "probes".  "Probe", in this context could 
mean the entire "device" that is intended to capture packets 
[for display or analysis].  That would include the 
NIC/PC/sniffer_software/(etc?) being used.  Are there dedicated devices for 
packet capture/analysis, other than the engineering devices that may be 
known as protocol/communication analyzers?

Referring to your orginal post, I meant the NIC/PC (/sniffer_program) would
be the limiting factor in that setup, assuming that the action of mirroring a 
switch port did not itself cause dropped packets.   I've been told that some
switches cannot mirror 100% of a "busy" port, their "internals" not being able
to "handle the load".  I guess it depends on the design.

AFAIK, the only way to avoid that potential problem is to (1) use a single speed 
"hub", of correct speed, plugging into it the PC/Monitor, the switch port to be 
monitored and the cable orginally in the switched port.  That way all the
traffic will be repeated on all ports.  (2) use a "tap".

The "tap" should have the advantage of not allowing any packets from the NIC/PC
to make its way back to the network.  This is advantageous if sniffing in a danger 
zone where worms, scanners, etc, might exist.  

joea.




7/9/03 5:17:14 AM, "Michel Vanden Bossche" <m.vdb@xxxxxxx> wrote:

>Thanks Joea,
>
>However there are probes that capture at 100 Mbps and others at 2 or 32 Gbps
>(much more expensive).
>Are NIC & PCs  doing better then probes?
>
>Kind Regards
>Michel
>
>-----Original Message-----
>From: Joe Acquisto [mailto:joea@xxxxxxxxxxxx] 
>Sent: dimanche 6 juillet 2003 18:12
>To: Michel Vanden Bossche
>Subject: Re: [Ethereal-users] Capture speed
>
>
>7/6/03 10:10:05 AM, "Michel Vanden Bossche" <m.vdb@xxxxxxx> wrote:
>
>>
>>
>>  From:   "Michel Vanden Bossche" <m.vdb@xxxxxxx>
>>
>>  To:     <ethereal-users@xxxxxxxxxxxx>
>>  Date:   Sun, 6 Jul 2003 16:10:05 +0200
>>  Subject:[Ethereal-users] Capture speed
>>
>>
>>
>>  Hi,
>>   
>>  If we capture an enterprise traffic on a switch by mirroring all 
>> traffic on  the port where we capture.
>>   
>>  What is the maximum speed we can capture without losing packets?
>>   
>>  Does it depends on the NIC type?
>>   
>>  Does it depends on the PC processor?
>
>Same as a hub.  Assuming the switch can mirror all the traffic.  Meaning if
>the switch itself does not drop 
>packets.  
>
>The PC, OS and NIC are not the limiting or determining factors here.
>
>joea/
>
>
>
>