Re: Endace DAG card

[Alberto Ornaghi <alor () fastwebnet it>]

Michele Sciuto wrote:
> Since I need the acquired data in libpcap format, I was wondering if it
> would be better to use dagsnap followed by dagconvert or, alternatively,
> tcpdump with the dag patch. Does somebody know which is the best choice,
> considering performance?

IMHO the libpcap patch works fine and a simple pcaploop is enough to
capture data and write it in pcap format.
take care of the buffering on the disk it can impact your performance.

> And again, so far I can see the card as /dev/dag0 and I just used
> dagsnap to capture data. Somehow, is it possible to see the dag
> interface with ifconfig (I mean configuring it in
> /etc/network/interfaces), in order to use netstat to check the counters?

you have to use dagfour / dagconfig / dagstat in order to get the counters.
the DAG cards are viewed by the system as special device, they are not
network interface.

bye
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.