Wire-speed gigabit analsys

Does anyone know what to use to perform protocol analysis or filtering applications on gig enets w/o dropping packets? Do any std NICs work?

Help is appreciated

Sglad,

Even though this is something I haven't tried, sniffing Gigabit networks should be the same as sniffing any normal type of network.

As usual, you will need a workstation connected to the Gigabit network switch and a sniffing program to capture your data.

The problem here is that you probably won't find any gigabit 'hub' around, so you will need to sniff data straight from the switch;

This is where you need to turn to special software that will allow you to sniff data directly from a switch, and even though the structure of a switch might make it seem an impossible task to do, there is software that will help you overcome this limitation.

Personally I use Ettercap (Linux). This is a great program with a simple to use interface. If your a pure Windows user, your going to have to wait for a long time until you see such intelligent software becoming available for that platform.

Cheers,

Chris P.

Chris, thanx for your reply. The other item(s) I really am trying to understand is:

- Do you really need wirespeed analysis - my experience dictates that a lot of packets can be missed at gig rates given standard NICs.

- How do you achieve the wirespeed analysis - do you know of any NICs that will not drop packets. How important is this.

<BLOCKQUOTE><font size="1" face="Verdana, Helvetica, sans-serif">quote:</font><HR>Originally posted by Admin:
<STRONG>Sglad,

Even though this is something I haven't tried, sniffing Gigabit networks should be the same as sniffing any normal type of network.

As usual, you will need a workstation connected to the Gigabit network switch and a sniffing program to capture your data.

The problem here is that you probably won't find any gigabit 'hub' around, so you will need to sniff data straight from the switch;

This is where you need to turn to special software that will allow you to sniff data directly from a switch, and even though the structure of a switch might make it seem an impossible task to do, there is software that will help you overcome this limitation.

Personally I use Ettercap (Linux). This is a great program with a simple to use interface. If your a pure Windows user, your going to have to wait for a long time until you see such intelligent software becoming available for that platform.

Cheers,

Chris P.</STRONG><HR></BLOCKQUOTE>

Sglad,

I really don't know how a 100mbit network card would react when sniffing data from a 1Gigabit network.

In theory, if the data transferred was within the 100Mbit limit, then no packets should be dropped, but if it exceeded that, then yes, it should start to drop packets simply because the incoming data would be much greater than the network card's capability to receive and process them.

However, there is another side to this, which I haven't confirmed as yet. In theory, a workstation or any inteligent device that is receiving more data than what it can process, would normaly send out a ICMP source quench packet to the source, telling it to take it easy and slow down because it can't process all the data its receiving.

When sniffing though data, you don't tell the source to stop sending data .. or do you ? [img]images/smiles/icon_smile.gif[/img]

So, the question that arises is: Would a workstation set in promiscuous mode (in other words, it's sniffing data) send out a ICMP source quench to the source of the incoming data or not ?

My guess is that it wouldn't, it simply dosen't make sence, but at the same time, when sniffing through a switch, your sniffing machine basically becomes the middle man (they use a method called ARP poissoning), so the source wouldn't know if the ICMP source quench packet came from machine that's sniffing or the actual destination machine !

Got you confused yet ? [img]images/smiles/icon_smile.gif[/img]

It's a good question actually and simply requires a bit of research in order to find the correct answer.

Let me know what your thoughts and findings are.

Cheers,

Chris P. [img]images/smiles/icon_cool.gif[/img]

[ 19 March 2003: Message edited by: Admin ]