[Winpcap-bugs] Windows 2003 Scalable networking pack causescaptures to be missing data...

[Gianluca Varenni]

This is a known issue for which there is no workaround.

When chimney is enabled, the TCP/IP driver bypasses the stack and communicates with the network card directly (that's the reason for the term chimney), there is no concept of packets flowing between the TCP/IP protocol driver and the miniport driver, TCP/IP passes buffers directly to the network card, which is in charge of dealing with all the TCP protocol management.

Given the current architecture of WinPcap, the only solution is to either disable chimney or use a separate machine for the capture.

Have a nice day
GV
  ----- Original Message ----- 
  From: Brian R Cowan 
  To: winpcap-bugs at winpcap.org 
  Sent: Thursday, November 20, 2008 12:39 PM
  Subject: [Winpcap-bugs] Windows 2003 Scalable networking pack causescaptures to be missing data...



  Is this a reported issue? Has it been looked at if so? 

  If the "TCP Chimney" is enabled in this pack, most TCP traffic disappears from WinPcap-based traces. I will see some syncs and handshakes, but that's about it. This means that SMB/CIFS traffic completely disappears from a capture, for example. Not good. 
  =================================================================
  Brian Cowan
  Advisory Software Engineer
  ClearCase Customer Advocacy Group (CAG)
  Rational Software
  IBM Software Group
  81 Hartwell Ave
  Lexington, MA

  Phone: 1.781.372.3580
  Web: http://www.ibm.com/software/rational/support/


  Please be sure to update your PMR using ESR at http://www-306.ibm.com/software/support/probsub.html or cc all correspondence to sw_support at us.ibm.com to be sure your PMR is updated in case I am not available.


------------------------------------------------------------------------------


  _______________________________________________
  Winpcap-bugs mailing list
  Winpcap-bugs at winpcap.org
  https://www.winpcap.org/mailman/listinfo/winpcap-bugs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-bugs/attachments/20081124/e90a9999/attachment.htm