Hardware Specifics for 10Gb Capture

edit

Doing it correctly can be costly. That's all for today. Now, let's focus on the path to the future. 10G circuits are becoming increasingly common. You must determine when the network will be upgraded to 40G, 100G, and 400G. I haven't seen 800G yet. And will this server be part of the upgrade, and can the platform support it?

I believe the best option is to buy a protocol analyzer that can capture at full port speed. If the product doesn't meet your expectations, you can contact the vendor to solve the issue and talk about possible software and hardware upgrades.

Go check out ntop, they specialise in these things as well.

You might try the #general channel on the Wireshark Discord.

https://sharkfest.wireshark.org/retro...
19: EXPERT PANEL: Pros & Cons of Building your own Capture Appliance by Sake Blok, Jasper Bongertz, Hansang Bae, Luca Deri, and Chris Greer (https://www.youtube.com/watch?v=fmVMk...)

https://sharkfestus.wireshark.org/sf14
I3: Maximizing Packet Capture Performance [PDF || PPT] by Andrew Brown
https://sharkfestus.wireshark.org/ass...

The Network Capture Playbook by Jasper Bongertz
https://blog.packet-foo.com/the-netwo...