[111913] in North American Network Operators' Group
RE: Capture problems with Intel quad cards?
daemon@ATHENA.MIT.EDU (Murphy, Jay, DOH)
Mon Feb 16 17:17:18 2009
Date: Mon, 16 Feb 2009 15:17:07 -0700
In-Reply-To: <alpine.LNX.2.00.0902160935410.7902@filesrv1.baby-dragons.com>
From: "Murphy, Jay, DOH" <Jay.Murphy@state.nm.us>
To: "Mr. James W. Laferriere" <babydr@baby-dragons.com>,
"John A. Kilpatrick" <john@hypergeek.net>
Cc: nanog@nanog.org
Errors-To: nanog-bounces@nanog.org
One more note.... it is a bridging chip, not switching, that is resident
on the board that is the communicator to the other NIC chipsets.
Jay Murphy=20
IP Network Specialist=20
NM Department of Health=20
ITSD - IP Network Operations=20
Santa Fe, New Mexico 87502=20
Bus. Ph.: 505.827.2851
"We move the information that moves your world."=20
-----Original Message-----
From: Mr. James W. Laferriere [mailto:babydr@baby-dragons.com]=20
Sent: Monday, February 16, 2009 11:39 AM
To: John A. Kilpatrick
Cc: nanog@nanog.org
Subject: Re: Capture problems with Intel quad cards?
Hello John ,
On Sun, 15 Feb 2009, John A. Kilpatrick wrote:
> Has anyone had problems with using current Intel quad ethernet cards
for=20
> packet capture? As a proof-of-concept test we bought an Intel
PWLA8494GT and=20
> hooked it up to some Network Critical taps. There was a very strange
issue=20
> with corruption of the captured packets. The *only* issue (but it's a
big=20
> one) is that the source IP on some captured packets is munged. As far
as I=20
> can tell that's the *only* issue with the packet captures - no other
data is=20
> corrupted.
>
> Oh, and to rule out other issues:
>
> 1. Corruption seen both when using network taps and when using a port
> span/mirror (so it's not the taps).
> 2. Corruption *not* seen using the on-board broadcom nics of the test
> host (so it's not the box).
>
> So I'm pretty sure we narrowed it down to the card. We tried the card
in
> an indentical host and saw the same problems.
>
> I thought it might be a driver issue - I tried both gentoo and FreeBSD
(not=20
> sure how different the drivers are) just to see if it mattered at all
and it=20
> didn't. Much googling didn't show this to be a known issue - just
wondering=20
> if anyone else has seen it? Other recommendations welcome - the next
step=20
> is, I suppose, a broadcom-based PCI-X card. (I've got some old pizza
boxes=20
> I'm trying to repurpose as network probes.)
>
> Thanks,
> John
Does this device provide 4 unique mac-addresses ? Reason for
the=20
question is some old(I mean old) multiport cards presented a single
mac-address=20
because the were driven by a single 'Switch chip' . Just a thought .
I've been=20
looking a the Intel site gandering over the overview & have not seen
anything to=20
relieve my concern . But one Hopes they have learned not to create
themselves=20
such a problem .
Hth , JimL
--=20
+------------------------------------------------------------------+
| James W. Laferriere | System Techniques | Give me VMS |
| Network&System Engineer | 2133 McCullam Ave | Give me Linux |
| babydr@baby-dragons.com | Fairbanks, AK. 99701 | only on AXP |
+------------------------------------------------------------------+
______________________________________________________________________
This inbound email has been scanned by the MessageLabs Email Security
System.
______________________________________________________________________
Confidentiality Notice: This e-mail, including all attachments is for the=
sole use of the intended recipient(s) and may contain confidential and p=
rivileged information. Any unauthorized review, use, disclosure or distri=
bution is prohibited unless specifically provided under the New Mexico In=
spection of Public Records Act. If you are not the intended recipient, pl=
ease contact the sender and destroy all copies of this message. -- This e=
mail has been scanned by the Sybari - Antigen Email System.=20
