I have a device that it receiving a large amount of traffic on its gigabit link. I'm slightly worried about running a standard capture on it as it may create performance issues for the device. My question is what methods can I use to limit the amount of traffic I have to capture, that would still allow me to report the statistics within wireshark or tshark. Can anyone confirm if tshark and wireshark uses the complete data payload when calculating the packet totals etc (i.e within the Protocol Hierarchy Stats), i.e and not just the TCP SEQ numbers in the case of TCP. As I was wondering if there is any way to only capture the headers and still be able to report the various protocol throughputs. Many Thanks, asked 30 Jan '13, 03:43  bart80 |
One Answer:
The stats will only be calculated for those parts of the packets that Wireshark can see. You'll need to ensure you capture enough to allow at least protocol detection for those protocols you want. Do you need this info in real-time? If not, you'd also be better off using dumpcap to capture as Wireshark (and TShark to a lesser extent) will run out of memory due to maintaining conversations data etc. answered 30 Jan '13, 04:13  grahamb ♦ showing 5 of 6 show 1 more comments |
It doesnt need to be in real time. So from what your saying as long as I capture the TCP headers or up to the first 100 bytes say, then I should be ok. I just wont be able to get too much in terms of UDP stats.
You could also miss out on stats where there are multiple pdu's, e.g. udp messages in a frame as the ones after the cutoff point won't be counted.
As you don't need this info in real-time I really recommend you use dumpcap for the captures.
Trouble with dumpcap is that it isn't always available on the device that I am capturing on. The good thing with TCPdump is that is it normally always preinstalled.
tcpdump is also OK. The main thing is not to use Wireshark or TShark due to the memory consumption when there is a lot of traffic.
Ah ok, so is there anything else I should consider when capturing traffic on a interface that is RX/TX around a gig per sec ?
Thanks for all your help...
Disk i/o speed. @jasper knows more, but in another question he thought you needed 240MB/s write speed.