Re: challenges in capturing Gigabit ethernet

hank.schupp_at_mantech-ist.com wrote:
> I've tried some experiments with collecting at high-speed off gigabit
> cards. Created a test system that generated traffic at varied rates
> from 10 mbs to 1 gbs.

What system ? On which hardware ? Which OS stack ? Which type of traffic ?

> Though the cards themselves reported very
> little loss (Endace products) the ability to write the data to disk

Which disk ? On which bus ?

> Understand also that the tests were not done under the most
> scientific conditions - still repeated testing showed our breakdown
> was primarily the ability to write the data to disk

hdparm -Tt (or similar) could help you pinpoint this.

-- 
Best,
Stefano Zanero
Ph.D. Student - Politecnico di Milano - Dip. Elettronica e Informazione
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------