[Winpcap-users] wireshark in high traffic environments, was:disabling chimney, was: Card info

[Gianluca Varenni]

----- Original Message ----- 
From: "Bryan Mclellan" <bryanm at widemile.com>
To: <winpcap-users at winpcap.org>
Sent: Wednesday, March 26, 2008 11:45 AM
Subject: RE: [Winpcap-users] wireshark in high traffic environments, 
was:disabling chimney, was: Card info


>I have yet to be convinced that TOE (and thus chimney) is of 'heavy' 
>performance benefit. Maybe the Windows TCP/IP stack just sucks, and 
>therefore most hardware based TOE implementations are that much better than 
>it. I suppose all of this is beside the point.
>
> I'd probably avoid running wireshark on any heavily used production server 
> and fall back on SPAN or something inline at that point. Or maybe capture 
> with tcpdump and analyze later with wireshark. OP left out many variables 
> that may have been interesting, who knows why OP has a 10gbps NIC. Best 
> practices for dealing with sniffing high traffic links is perhaps a more 
> interesting discussion. Hard to throw an hub in the link and I haven't 
> used enough 10gbps gear to know if you can use SPAN or not. Possibly 
> running wireshark on the server interface is the only reasonable way of 
> getting things done.
>

Forget about using Wireshark on a gigabit link. It's simply too slow to 
process such an amount of packets. You can capture with tcpdump on disk *if* 
you have a disk which is fast enough. At gigabit rates (I mean a saturated 
Gigabit link), you probably want to use RAID with striping.

Have a nice day
GV

> ________________________________________
> From: winpcap-users-bounces at winpcap.org 
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
> Sent: Wednesday, March 26, 2008 10:37 AM
> To: winpcap-users at winpcap.org
> Subject: Re: [Winpcap-users] disabling chimney, was: Card info
>
> The point here is not how to disable chimney. The point here is that if 
> you have a 10Gbps NIC on your server, it's because you need a high 
> performing network card during its normal operation (e.g. your server is a 
> high bandwidth web server or similar). Disabling chimney because you want 
> to run WinPcap on it can affect the performance of the whole server 
> heavily. Just be aware of it.
> Instead, if you are using a dedicated sniffing machine with a 10Gbps card, 
> disabling chimney makes perfectly sense. Actually disabling TCP/IP 
> completely on the network card makes even more sense.
>
> Just my two cents
> GV
>
> ----- Original Message -----
> From: Bryan Mclellan
> To: winpcap-users at winpcap.org
> Sent: Tuesday, March 25, 2008 9:36 AM
> Subject: [Winpcap-users] disabling chimney, was: Card info
>
> Oh chimney....
>
> Run 'Netsh int ip set chimney DISABLED' from the cmd prompt.
>
> http://loftninjas.org/blog/2007/12/wiresharkwinpcap-and-windows-server.html
>
>
> ________________________________________
> From: winpcap-users-bounces at winpcap.org 
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Sabbiolina
> Sent: Tuesday, March 25, 2008 2:07 AM
> To: winpcap-users at winpcap.org
> Subject: Re: [Winpcap-users] Card info
>
> tnx for fast answers.
> I hope to disable tcp Chimney:
>
> http://smallvoid.com/article/winnt-ndis6-network-features.html
>
> On Thu, Mar 20, 2008 at 11:20 PM, Gianluca Varenni 
> <gianluca.varenni at cacetech.com> wrote:
> I have no idea if the card works with WinPcap or not (I think it 
> implements TCP Chimney, WinPcap doesn't work if Chimney is in use), in any 
> case don't expect to capture at Gig rates :-(
>
> Anyways, I would be curious to know how fast you can capture on these 
> 10Gig cards.
>
> Have a nice day
> GV
> ----- Original Message -----
> From: Sabbiolina
> To: Winpcap-users at winpcap.org
> Sent: Thursday, March 20, 2008 12:59 PM
> Subject: [Winpcap-users] Card info
>
> Hi,
>    Someone tried this card with winpcap?
> Intel PRO/10GbE XF SR Server Adapter
> Tnx
> Sabbiolina
> ________________________________________
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> ________________________________________
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users
>
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users