The answer to life is 42 - You just need to know the question!.
Seriously, I have been involved in extensive speed trials on IA32 architecture and the
main limitation is the ability to empty the buffer on the card quick enough. A
expensive hobby.
However at 100Mbps a generally available late model Workstation should be fine. I have
found that only approaching 300Mbps does reliability start to deteriorate and this is
more to do with Bus speed. Don't be fooled into thinking a 100Mhz bus can transfer
100Mhz x 32 bits or even 64 bits per second, there is alot of redundancy going on.
Think about this:
Data in Buffer card
Data down PCI to Bridge
Data down bus to memory
Data in Memory
Data down Bus to Cache
Data in Cache
Data processed to cache
Data down bus back to memory
Data down bus to Bridge
Data down PCI To IDE/SCSI ...
Data to Disk cache
Data block dump to disk (including hardware cache).
Basically lots of Bus work. Even with DMA it's your bus speeds, your bridge speeds and
your cache/block write sizes that count.
At 100Mbps running on a PIII850 with 166Mhz bus, with 256MB RAM, Realtek 8139 Generic
(choose carefully) Adapter and Quality matched Ram, I have experienced no drop-out,
and this architecture can go much higher - 300Mbs+. I think this motherboard was an
ABit with Intel Bridge (?) but I really don't think you have an issue with the popular
bridges. The other consideration is the network adapter you use. Purely my experience,
and it has not been exhaustive, but cheaper (simpler) cards seem to perform more
reliably, and IMHO avoid 3Com for this kind of work.
No worries,
Jonathan
-----Original Message-----
From: Justin Funke [mailto:[EMAIL PROTECTED]]
Sent: 09 June 2002 22:12
To: [EMAIL PROTECTED]
Subject: Tcpdump hardware requirements for a 100mb line tap
I am going to deploy tcpdump on a full duplex LAN tap capturing the full
packets (-s 1500)
Does anyone know what the processor/ram requirements would be to just
write these packets to a file.
I don't think it would take much but finding specifics is proving to be
difficult.
Thanks,
Justin.
