Ask Your Question

Revision history [back]

Short answer: No. Reliable 1GBit/s full line capture is still a hard task. You still need special capture devices and drivers. But there seems to be a sw solution from ntop https://www.ntop.org/products/packet-capture/pf_ring/ which should work some intel cards. (But I have never tested).

I have tested some special capture devices and I personally recommend the usage of such devices.

Short answer: No.

Longer Version:
Reliable 1GBit/s full line capture is still a hard task. You still need special capture devices and drivers. But there seems to be a sw solution from ntop https://www.ntop.org/products/packet-capture/pf_ring/ which should work some intel cards. (But I have never tested).

I have tested some special capture devices and I personally recommend the usage of such devices.

Also have a look here:

https://blog.packet-foo.com/2016/11/the-network-capture-playbook-part-3-network-cards/

https://crnetpackets.com/2018/03/17/how-to-turn-your-computer-into-a-high-precision-packet-capture-machine-with-the-profishark-1g/

Short answer: No. No, Gigabit full line capture is still not easy..

Longer Version:
Reliable 1GBit/s full line capture is still a hard task. You still need special capture devices and drivers. But there seems to be a sw solution from ntop https://www.ntop.org/products/packet-capture/pf_ring/ which should work some intel cards. (But I have never tested).

I have tested some special capture devices and I personally recommend the usage of such devices.

Also have a look here:

https://blog.packet-foo.com/2016/11/the-network-capture-playbook-part-3-network-cards/

https://crnetpackets.com/2018/03/17/how-to-turn-your-computer-into-a-high-precision-packet-capture-machine-with-the-profishark-1g/