Hi, I was checking some capturing methods while I wait for a TAP purchase to go through: I noticed that when I mirror a port there is a LOT of slow down in the delivery of the packets to me. The client has long since finished his session and the mirror is still delivering packets from it. Okay, switch may be busy, lets try a hub. Delay is now gone, everything looks good: Except that the packets are coming in in bursts. Every 15-16ms a large chunk of data arrives all with the same Timestamp, down to microseconds, which obviously makes reading the trace later somewhat interesting with out of order and retransmissions all occurring at the same time. I do not know 100% what is an issue and what is not. Is this usual behaviour or is my hub ever so slightly mad? Am I just going to have to wait for my dedicated TAP to be really be sure? asked 16 Jul '15, 23:56  DarrenWright |
One Answer:
Sounds like both SPAN and hub are doing things in a strange way, so yes, go for a TAP to see what really happens. answered 17 Jul '15, 01:41  Jasper ♦♦ |
Hi Jasper, yeah. I managed to finally get a sign off on the ProfiShark 1G. Now I just need to wait some time..