Re:Ethereal performance

On Thu, 27 Jul 2006 07:23:34 -0600, <[email protected]>  
wrote:

> Has anyone done any serious performance testing of
> Ethereal as regards network capture performance?
> I'm trying to evaluate performance by capturing a
> gigabit Ethernet link with this configuration :
> •OS Linux Debian
> •Pentium 4 processor
> •2 GB memory
> •Ethernet card : Intel 1000 CT
> I need to monitor a 600 Mbits/s link but actually, I
> can’t capture more than 230 Mbits/s without dropping
> packets.
> What are the important parameters (hardware, OS…) in
> the aim to monitor a full gigablt link.

The network card itself is critical here. Here  
(http://www.digit-life.com/articles2/gigeth32bit/gig-eth-32bit-2.html) are  
some speed comparisons of various cards. To get throughput on the order  
you are talking, you need a fast processor (hopefully dual core) and a  
pci-x card. The Pro1000 is in general the fastest of the 32bit cards, at  
least as reported in the article cited above. It seems that under ideal  
conditions, it might be able to keep up. However, I suspect the tests were  
the only thing the computers were doing at the time, and that no ethereal  
was running. Note that the Pro1000 did have the lowest CPU usage under  
Windows 2k: no info about Linux.  Also note that with some jumbo frames,  
the Pro1000 performance suffered significantly. What size are the frames  
you are trying to capture?

--john
-- 
John McDermott, CPLP, CCP
Writer, Educator, Consultant
jjm at jkintl.com        www.jkintl.com
V: +1 505/377-6293  F: +1 505/377-6313