Wireshark-users: Re: [Wireshark-users] How to build a 10Gbe test environment and monitor it with

From: Patrick Klos <patrick@xxxxxxxx>
Date: Tue, 02 Apr 2013 10:06:02 -0400
David Aldrich wrote:

Hi

 

I need to build a test environment to communicate with a hardware device that has a 10Gbe comms port and that uses a SFP+ connector.  I will debug the connection using Wireshark.

 

So I need a 10Gbe NIC for a Windows/Linux PC, and that NIC should have a SFP+ connector.


Hello David,

Typically, monitoring a 10Gb link involves using a tap (or a switch with a SPAN port).  Are you using copper or fiber?  Depending on the load you expect on the 10Gb link, you might even need a filtering tap.

Would anyone like to recommend a suitable NIC please?


If you have a decent tap and can filter the data you care about to less than 1Gbps, you can filter the 10G in the tap and feed it to your Wireshark system over a 1G link. 

If you have to have a 10Gbps NIC, there are plenty to choose from, and just about all of them are based on one of a few Intel controllers.  If you have a budget that permits, there are several companies that make 10Gbps boards specifically designed for packet capture, but they can be pricey from what I understand.

Will there be any issues with monitoring such a connection using Wireshark?


Windows systems usually have more overhead than allowed for effective high bandwidth capture - I suspect you'd have better luck with the Linux base for running Wireshark on heavy loads.

The biggest question you should answer before starting this quest is what kind of loads will you (ultimately) need to monitor?  That will help determine what kind of equipment you'll need to consider for your final solution.

Good luck,

Patrick Klos
Klos Technologies, Inc.