Wireshark-users: Re: [Wireshark-users] Capture hardware

From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Tue, 13 May 2008 22:21:02 -0400
Kok-Yong Tan wrote:
[snip]
I know that Laura Chappell mentioned in Sharkfest 2008 the need for special tools for gigabit packet capture and that gigabit NICs won't work (I'm a newbie to gigabit packet capture so I'm not clear about the details since Ms. Chappell made cheetahs look like turtles during Sharkfest--can someone enlighten me as to why a single gigabit NIC will not work for full-duplex gigabit packet capture? Does it have to do with it being lossy due to the speed of the NIC overwhelming the speed of the data bus on most computers?)

Imagine this:
PC sends 1Gbps  ---(TX)---->  to Server
PC receives     <--(RX)----- 1Gbps from the server.


Now you span TX and RX to *one* Gigabit NIC. You cannot fit 2Gbps worth of traffic to a 1Gb NIC.




--

Thanks,
Hansang