Ethereal-dev: Re: [Ethereal-dev] Capturing large amounts of data and at high speeds
I've been looking for hardware to capture for a while (not at the
speeds you propose).
I think the hardware that turns out to be more adequate is the
hardware used for NAS (network attached storage) this machines happen
to have the same need that capture has: a good net to disk throughput.
Although I haven't tested their HW, I believe TeamASA has very
promising HW for capturing at high speeds. http://www.teamasa.com
Using two different boxes for dumping TX and RX doubles the capacity as well
Using ethernet switches just for capturing after the splitter and
"poisoning" their FDBs caan help load balancing between a group of
cheaper boxen.
As my experience goes with a 4 porcessor SunFire 480 with two fiber
gigabit ethernet adapters and a raid-5 set we were able to capture at
wirespeed on a saturated Gb link not loosing packets.
I Hope this helps.
On 4/15/05, Richard Sharpe <rsharpe@xxxxxxxxxxxxxxxxx> wrote:
> Hi,
>
> I am starting to worry about capturing large amounts of data and at high
> rates, and then processing it.
>
> For example, I would like to capture, say, a whole IOZONE run with 8
> threads all transferring 5GB of data over GigE. That's 40 or more GB of
> capture data. Although, I can cut the length captured for each frame, it's
> still a lot of data, and if I want to grab say, the write, rewrite, read
> and reread sessions, that is 4 times as much data.
>
> My next interest is going to be to capture 10GigE traffic of the same
> sort.
>
> What sort of capture devices can we use that can sustain such data rates?
>
> Could we use passive taps, but if we do, that is two GigE streams to
> worry about.
>
> Could we use a 64-bit processor, with, say, 64GB of memory, and capture to
> memory, and only write to disk after the capture is over (I worry about
> having enough memory bandwidth to capture and write that stuff all at
> once).
>
> Something to think about, eg.
>
> Regards
> -----
> Richard Sharpe, rsharpe[at]richardsharpe.com, rsharpe[at]samba.org,
> sharpe[at]ethereal.com, http://www.richardsharpe.com
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan
