On Nov 20, 2011, at 2:15 PM, Kevin Cullimore wrote:
> in either case, no reason NOT to use dumpcap/tcpdump/windump for these purposes . . .
As long as it's "capture and then look at it later" (which is probably the case if you're capturing full-on GigE), yes.
However, if it's a kernel panic, the issue may have nothing to do with whether you're watching the traffic while you're capturing it, and may pop up even with a relatively simple userland network->file code path, or with a faster CPU, or....