I am experiencing some proof of concept of using ethereal to replace our distributed sniffer and I see some differences between the traces. It would runs on gigabits links, on a RH-9 with 1GB Ram on with altheon gigabit cards on optic fiber (SX) We are spanning ports using Cisco 6509
I have 2 interfaces in my proof of concept box, one to sniff and one to access it... I am accessing it through eth1 and sniffing with eth0 eth0 is promiscous and have no IP address... Here's some quick numbers from a quick trace :-) Distributed sniffer: 2844520 packets captures, no drop tcpdump: 2842639 packets captures, some drop (1881) tcpdump -w /dev/null -i eth0 But doing it with ethereal gives 2830298 packets captures, some drop (14222) So I turned the swap off and did the same test (swapoff -a)... no program in swap should increase the performance due to page swaping time... Distributed sniffer: 3025830 packets captures, no drop tcpdump: 3013675 packets captures, (1105 drops) ethereal: 2984633 packets captures, (30147 drops) The switch reports no errors on the ports The interface on which I sniff reports no error or dropped The ethereal -v issue the following ethereal 0.9.16 Compiled with GTK+ 1.2.10, with GLib 1.2.10, with libpcap 0.7.2, with libz 1.1.4, with Net-SNMP 5.0.6, without ADNS Running with libpcap (version unknown) on Linux 2.4.20-6 As of libpcap rpm -qa | grep libpcap returns the following libpcap-0.7.2-1 Now, here are my questions: 1- why does tcpdump don't get the same amount of packets as a regular sniffer (Dolch for instance) I am using one of the best gigabit card on the market I should get the same result. BTW the altheon card can be driven to wire speed, I saw it on an Auspex. 2- why does ethereal which uses tcpdump don't read the same amount of packets ? 3- is there a any work around ? 4- Any other way than tcpdump (libpcap) to sniff and get no or less packet drops, with ethereal ? Any help will be appreciated M.H.
