[Winpcap-users] wireshark in high traffic environments, was: disabling chimney, was: Card info

[Bryan Mclellan]

I have yet to be convinced that TOE (and thus chimney) is of 'heavy' performance benefit. Maybe the Windows TCP/IP stack just sucks, and therefore most hardware based TOE implementations are that much better than it. I suppose all of this is beside the point.

I'd probably avoid running wireshark on any heavily used production server and fall back on SPAN or something inline at that point. Or maybe capture with tcpdump and analyze later with wireshark. OP left out many variables that may have been interesting, who knows why OP has a 10gbps NIC. Best practices for dealing with sniffing high traffic links is perhaps a more interesting discussion. Hard to throw an hub in the link and I haven't used enough 10gbps gear to know if you can use SPAN or not. Possibly running wireshark on the server interface is the only reasonable way of getting things done.

________________________________________
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
Sent: Wednesday, March 26, 2008 10:37 AM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] disabling chimney, was: Card info

The point here is not how to disable chimney. The point here is that if you have a 10Gbps NIC on your server, it's because you need a high performing network card during its normal operation (e.g. your server is a high bandwidth web server or similar). Disabling chimney because you want to run WinPcap on it can affect the performance of the whole server heavily. Just be aware of it.
Instead, if you are using a dedicated sniffing machine with a 10Gbps card, disabling chimney makes perfectly sense. Actually disabling TCP/IP completely on the network card makes even more sense.

Just my two cents
GV

----- Original Message -----
From: Bryan Mclellan
To: winpcap-users at winpcap.org
Sent: Tuesday, March 25, 2008 9:36 AM
Subject: [Winpcap-users] disabling chimney, was: Card info

Oh chimney....

Run 'Netsh int ip set chimney DISABLED' from the cmd prompt.

http://loftninjas.org/blog/2007/12/wiresharkwinpcap-and-windows-server.html


________________________________________
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Sabbiolina
Sent: Tuesday, March 25, 2008 2:07 AM
To: winpcap-users at winpcap.org
Subject: Re: [Winpcap-users] Card info

tnx for fast answers.
I hope to disable tcp Chimney:

http://smallvoid.com/article/winnt-ndis6-network-features.html

On Thu, Mar 20, 2008 at 11:20 PM, Gianluca Varenni <gianluca.varenni at cacetech.com> wrote:
I have no idea if the card works with WinPcap or not (I think it implements TCP Chimney, WinPcap doesn't work if Chimney is in use), in any case don't expect to capture at Gig rates :-(

Anyways, I would be curious to know how fast you can capture on these 10Gig cards.

Have a nice day
GV
----- Original Message -----
From: Sabbiolina
To: Winpcap-users at winpcap.org
Sent: Thursday, March 20, 2008 12:59 PM
Subject: [Winpcap-users] Card info

Hi,
    Someone tried this card with winpcap?
Intel PRO/10GbE XF SR Server Adapter
Tnx
Sabbiolina
________________________________________
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

________________________________________
_______________________________________________
Winpcap-users mailing list
Winpcap-users at winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users