Revision history [back]

When capturing packets with a computer I always worry about the traffic exceeding the computer hardware and/or software capabilities. I tried to find a computer with two NICs, 128G ram, and a large SSD. Common issues I found is insufficient memory, 60%-70% NIC card limitation, microbursts, and aggregate traffic (ingress+egress mirror ports) exceeds the NIC line speed. This is probably an overkill for your situation, The sniffers we use for 10G line speed captures have two 10G zero-loss ports, NDIS drivers, multiple SSD drives, and 128G ram. Expensive, but no packet loss. If it is high priority, then try to lease a sniffer.

When capturing packets with a computer I always worry about the traffic exceeding the computer hardware and/or software capabilities. I tried to find a computer with two NICs, 128G ram, and a large SSD. Common issues I found is insufficient memory, 60%-70% NIC card limitation, microbursts, and aggregate traffic (ingress+egress mirror ports) exceeds the NIC line speed. This is probably an overkill for your situation, The sniffers we use for 10G line speed captures have two 10G zero-loss ports, NDIS drivers, multiple SSD drives, and 128G ram. Expensive, but no packet loss. If it is a high priority, then try to lease a sniffer. sniffer.