... Thanks for your prompt answers.
I indeed intend to use ethereal on a switched port with mirroring.
I will use a pentium 4, W 2K and a Gbps NIC (at 100$ from 3com)
Do you have any idea to which speed I can capture without dropping packets
with ethereal (we suppose the switch doen't drop packets), 300 Mbps, 500
Mbps,...?
-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxxxx]
Sent: vendredi 18 juillet 2003 1:42
To: Ian Schorr
Cc: Michel Vanden Bossche; ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Capture with Gbps NIC
On Thursday, July 17, 2003, at 4:36 PM, Ian Schorr wrote:
> I'm assuming you're wanting to know if there is something general
> about gigabit ethernet that would prevent promiscuous mode on <some
> platform>. I'm not aware of any general limitations of libpcap on any
> platform that prevent promiscuous capture on, generally, gigabit NICs.
Or perhaps he wants to know whether capturing in promiscuous mode on a
gigabit network would supply so much traffic that Ethereal would have a
problem keeping up. If so, the answer is probably "yes" if the wire is
running at full speed. Of course, promiscuous mode is only partially
relevant to that; what really matters is the rate of traffic, but if
you're on a gigabit hub, *if* such things exist, or if you're on a
switched port that's been set up as a mirrored port, that means you
could see more traffic than you'd see on a regular switched port (and,
in fact, if you're on a mirrored switch port, you could see more
traffic than will fit on the gigabit link between you and the switch,
in which case the *switch* will drop packets that won't fit on the
link).