This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark is increasing the value of the BandWidth

0

Hello everyone!

Currently I am developing a Linux Kernel Module that encrypts (AES) some data on an IPv6 packet. I need to know how the BW (BandWidth) will behave after the module has been inserted. To do that I am using iperf3. Here is my scenario

PC1 (windows 8.1) - Iperf client
PC2 (windows 8.1) - Iperf server
R1 (Router, which is actually a PC running Debian wheezy with two ethernet interfaces, one on-board and the other one is an Intel pro PCI express).
PC1 is connected to R1, and R1 is connected to PC2. I wanna know how the BW (between PC1 and PC2) will be affected after my LKM is inserted in R1.

I have done all the coding and the module is running ok, but the impact on the BW is really severe (I am using Linux crypto API to do the encryption). Anyway, I have run into a very strange situation. Whenever I am running iperf I get a value X of BW, however when I open Wireshark on R1 (to capture the packets going to PC2) the BW becomes 2*X. Exactly the BW shown on iperf is doubled when I open Wireshark on R1. I noticed that Wireshark puts the Ethernet interface in promiscuous mode. So I closed Wireshark and manually set the card to promiscuous, but there was no effect on the BW.

Has anyone noticed that Wireshark actually caused a better BW value? Am I missing something?

Thank You very much!

asked 11 Nov '15, 05:16

Phil%20Lima's gravatar image

Phil Lima
6112
accept rate: 0%

edited 11 Nov '15, 08:17

Jaap's gravatar image

Jaap ♦
11.7k16101

Try running the capture with promiscuous mode off. It's a setting on the capture interface window.

(11 Nov '15, 08:18) Jaap ♦

Can u run Wireshark on PC1 and PC2 and do the same....

(11 Nov '15, 19:01) srinu_bel

One Answer:

0

Please check if LRO (large receive offloading) is enabled on R1

ethtool -k eth0 | grep -i offload

If it is enabled, try to disable it with the following command and then repeat the iperf test with and without tcpdump running!

ethtool -K eth0 lro off

If that does not help, you can also try to disable other offloading methods as well.

BTW: Enabling promiscuous mode 'can' disable LRO, so this might explain what you are seeing. I can't explain why you did not see any difference while you put the interface in promiscuous mode manually, but I don't know how you did it.

See also here.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1027511

It's for VMware, but it should apply to a real box as well (depends on the driver).

Regards
Kurt

answered 11 Nov '15, 14:30

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 11 Nov '15, 14:33