This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Passive Capture

0

I was wondering if anyone has tried using a multiport gigabit switch adapter NIC such as the HP NC150T whilst capturing traffic, and if so does it affect results when capturing, such as jitter and delay at all? I am trying to model the affects of any virtualisation overhead on QoS for RTSP traffic.

How have you used them, as packets pass-through or tap off from the source/destination?

Regards

Papasean

asked 27 Aug '12, 05:39

Papasean's gravatar image

Papasean
1111
accept rate: 0%


One Answer:

0

In advance: I have not used that adapter (kind of "interesting" concept).

According to the available docs, it's an unmanaged switch powered by the PCI card and internally connected to the server NIC on the same PCI card. As it's an unmanaged switch I don't think you can configure port mirroring on the switch. So you will be able to capture only the traffic to/from the server while running Wireshark on the server. As such, I don't see any advantage of this adapter for packet capturing.

and if so does it affect results when capturing, such as jitter and delay at all?

Capturing network packets is a passive process, so there "should" be no influence on the captured packets. HOWEVER, if the capturing system is overloaded, it may drop packets or tag the packets with varying/wrong time stamps, which may result in wrong jitter calculation during the analysis of the data. To make that happen, the capturing machine must be heavily overloaded. Not a good foundation for proper network analysis ;-)

I am trying to model the affects of any virtualisation overhead on QoS for RTSP traffic.

How is that related to the NIC in use?

Regards
Kurt

answered 27 Aug '12, 10:11

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%