[111914] in North American Network Operators' Group
Re: Capture problems with Intel quad cards?
daemon@ATHENA.MIT.EDU (Bill Bogstad)
Mon Feb 16 18:01:19 2009
In-Reply-To: <alpine.BSF.2.00.0902152122380.86558@gobea.hypergeek.net>
Date: Mon, 16 Feb 2009 18:01:02 -0500
From: Bill Bogstad <bogstad@pobox.com>
To: "John A. Kilpatrick" <john@hypergeek.net>
Cc: nanog@nanog.org
Reply-To: bogstad@pobox.com
Errors-To: nanog-bounces@nanog.org
On Mon, Feb 16, 2009 at 12:35 AM, John A. Kilpatrick <john@hypergeek.net> wrote:
>
> Has anyone had problems with using current Intel quad ethernet cards for
> packet capture? As a proof-of-concept test we bought an Intel PWLA8494GT
> and hooked it up to some Network Critical taps. There was a very strange
> issue with corruption of the captured packets. The *only* issue (but it's a
> big one) is that the source IP on some captured packets is munged. As far
> as I can tell that's the *only* issue with the packet captures - no other
> data is corrupted.
Dumb question... It sounds like you've only used the card in packet
capture mode (i.e. promiscuous mode). Have you tried testing the card
just for normal host-to-host network flows? Maybe you have a bad
card?
If you still see problems on host-host flows, it's more likely to be a
bad card rather then a bad driver. (Given that a driver that can't
handle host-host flows is going to be obvious pretty quickly.)
Good Luck,
Bill Bogstad
