All, I do appreciate everybody who participated in such a meaningful discussion so far. That was far more than I had expected initially (well, I have to admit that my original question was somewhat vague to be honest:-)). I will try to collect a hardware (NIC, bus, etc.) and software (operating system, driver, packet filtering mechanism, etc.) that seem to be considered most appropriate to get the best result, based of suggestions appeared in this thread. If there's any new finding, I'll come back here and share it with you all. Thanks!
Regards, From: "Loris Degioanni" <[EMAIL PROTECTED]> Subject: Re: [tcpdump-workers] advice for heavy traffic capturing Date: Fri, 13 Aug 2004 09:45:31 -0700 > Hi, > > > > In some email I received from Loris Degioanni, sie wrote: > > > Other things: > > > - modern network cards don't almost do buffering. The memory inside the > > > board is usually few KB, and its purpose is providing the space for a > packet > > > or two. The actual buffering is done in the RAM of the PC. What > determines > > > the card performance is PHY efficiency and PCI bandwidth usage. > > > > Ok, so what do you have to say about NICs that have 128k buffers vs the > > small buffers on other cards? > > > > I don't have anything specific to say about them, since I've never used one. > I've worked with Intel cards: both Fast and Gigabit Ethernet ones have > descriptors and packet buffers in the RAM. The only reason why big buffers > inside the card can be useful is better PCI bus usage. But my experience is > that PCI limits are almost reached with 4-8K transfers. > > Loris > > - > This is the tcpdump-workers list. > Visit https://lists.sandelman.ca/ to unsubscribe. > - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
