Ethereal-users: RE: [Ethereal-users] Capture with Gbps NIC

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Michel Vanden Bossche" <m.vdb@xxxxxxx>
Date: Fri, 18 Jul 2003 09:50:45 +0200
... Thanks for your prompt answers.
I indeed intend to use ethereal on a switched port with mirroring.
I will use a pentium 4, W 2K and a Gbps NIC (at 100$ from 3com)

Do you have any idea to which speed I can capture without dropping packets
with ethereal (we suppose the switch doen't drop packets),  300 Mbps, 500
Mbps,...?

-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxxxx] 
Sent: vendredi 18 juillet 2003 1:42
To: Ian Schorr
Cc: Michel Vanden Bossche; ethereal-users@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] Capture with Gbps NIC



On Thursday, July 17, 2003, at 4:36 PM, Ian Schorr wrote:

> I'm assuming you're wanting to know if there is something general
> about gigabit ethernet that would prevent promiscuous mode on <some 
> platform>.  I'm not aware of any general limitations of libpcap on any
> platform that prevent promiscuous capture on, generally, gigabit NICs.

Or perhaps he wants to know whether capturing in promiscuous mode on a 
gigabit network would supply so much traffic that Ethereal would have a 
problem keeping up.  If so, the answer is probably "yes" if the wire is 
running at full speed.  Of course, promiscuous mode is only partially 
relevant to that; what really matters is the rate of traffic, but if 
you're on a gigabit hub, *if* such things exist, or if you're on a 
switched port that's been set up as a mirrored port, that means you 
could see more traffic than you'd see on a regular switched port (and, 
in fact, if you're on a mirrored switch port, you could see more 
traffic than will fit on the gigabit link between you and the switch, 
in which case the *switch* will drop packets that won't fit on the 
link).