USB Adapter with packet drops
Hey,
I've bought a USB 3.0 10/100/1000 Ethernet adapter with an AX88179 chip from UGREEN (https://www.amazon.de/UGREEN-Netzwerk...) as capture device for my Win10 client. It's connected to a span port of an Netgear GS108Tv3 switch.
When I did the first capture I realized that there are a lot of "Previous segment not captured" messages in different TCP streams. So I started a second capture on the client side interface to compare the captures. The capture of the client looked fine. No errors or drops. But the capture of the USB adapter showed about 200 "Previous segment not captured" messages in one minute of 200 kbit/s traffic.
I've already did the following troubleshootings:
- Changed driver of US Adapter to original ASIX drivers -> same behaviour
- Checked adapter with another client -> same behaviour
- Started capture with the internal on-board-LAN port of my client on the same span port -> no "Previous segment not captured" messages. Conclusion: Span port is fine:
- USB adapter works fine as LAN interface. 952 Mbit/s throughput (iPerf3) without unusual error frames.
- Disabled all energy-saving and offloading options of USB adapter -> same behaviour
- Captured with dumpcap.exe. -> same behaviour. The summary at the end says "No lost packets"
Now I'm not sure if the adapter has a defect, or if something blocks the missing packets. Use anybody else the adapter from UGREEN? Or has anybody an idea what's going wrong here?
Thank you. Jas
During your ipref test, was the interface in promiscuous mode? That seems to be a differentiator here.
All captures I did were done in promiscuous mode, so also the capture during the iPerf test.
I often see issues with USB adapters and traffic collection. Sometimes they pull in all traffic OK, other times they drop specific streams (say all multicast or traffic from a specific IP). I find that dedicated tools such as Profishark from Profitap do this sometimes too, so it's not just cheap USB adapters. I'm sorry I don't have a solution but I also find resetting the adapter often solves the problem for a short period of time. I have come to rely on builtin ethernet ports as much as possible for critical data traffic collection.
I agree that there are some adapters which are having problems to capture all the traffic. But due to my experiences, and also as you've commented, they're missing all packets of a special type or pattern then. In my case only some single packets of different streams get dropped. When I compare the capture from the client (which contains all packets) and the one from the USB adapter, the missing packets are having no common pattern. Looks more like something is blocking or discards the packets.
I was able to test another adapter with AX88179 chipset from Unplugable (USB3-E1000), and it has the same issue. So no hardware issue. But I wonder that nobody else noticed this behaviour. As I know the AX88179 chipset is recommend to easily capture VLAN tags in Windows.
I will now use my on-board LAN interface as capture interface, and the USB adapter as network connection.
If anybody can recommend a USB adapter as capture device including VLAN tags for Windows, please let me/us know :-)