Ethereal-users: [Ethereal-users] Terrible capture rates

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Ian Schorr <spamcontrol2@xxxxxxxxxxx>
Date: Thu, 13 Mar 2003 04:49:50 -0500
Tuesday I performed some more performance testing with Ethereal.

I finally got various NICs working on my Redhat Linux test machine (dual-booting Redhat 8 with kernel 2.4.18-14 and Redhat 7.3 with kernel 2.4.18-3), but I'm seeing capture performance much lower than I expect.
Using a gigabit packet generator, I've been generating various loads for 
the box.  I'm finding, however, that even at relatively low rates 
(7MB/s), and for short times (send 150MB total), Ethereal/tethereal 
either doesn't capture, or isn't passed 30% of the packets I send.  At 
higher rates (but still low), Ethereal only manages to capture 40% of 
the packets on the wire.  The adapter is seeing the packets, as netstat 
-i counters are increasing by the exact number of frames that I send.
Let me describe my setup.  The capture device is running dual Athlon XP 
1800+ processors, 512MB DDR RAM, SysKonnect SK-9844 or SK-9843 64-bit, 
66mhz GigEth NICs.  I'm generating 1000byte frames only.  I'm performing 
no frame slicing, and have been capturing either with tethereal (and 
writing directly to a disk file), or with Ethereal (and capturing to 
RAM).  I've tested a wide variety of settings, from high data rates 
(45MB/s), low (7MB/s), "bursty", long tests (20 minutes and quite a few 
gigabytes of data), and short ones (as low as 100MB of data sent).
CPU doesn't seem to be sweating at all during most of my tests (20% used 
or below), and at no disk paging is occurring.  I've also tried turning 
SMP off, but I saw no noticable difference.
Tethereal is reporting only seeing a certain number of frames (again, 
30-70% or so), and reports 0 dropped.  I'm not 100% sure whether the 
kernel is compiled to allow drop reporting, so I'm not sure what this 
symptom is telling me.
Any suggestions on what might be happening here?  I get MUCH better 
rates in Windows with the exact same system configuration.  I'm going to 
try eliminating the cards/driver by using a NetGear GA620, and check 
TCPDump to see if I get similar results, but otherwise I'm open to 
suggestions on what to check/try...
Thanks,
Ian