Tip of the Month

January 2004

I only receive 100Mbps

When capturing on a 100 full duplex connection, there is actually 200Mbps. 100Mbps for sent traffic and 100Mbps for traffic received. An analyzer is only able to take advantage of 100Mbps bandwidth due to the fact that the analyzer is only receiving traffic and is not sending. (As a note, the analyzer should still be able to send notifications but we do not count this traffic since it does not relate to capture tracefile.)

Most switches handle over 100Mbps traffic well by buffering the access traffic up to a certain point. If traffic is sustained at over 100Mbps, then packets will be lost.

There are two methods of working around this issue. The first is to port mirror to multiple ports and send the ‘sent’ traffic to one mirrored port and the ‘receive’ traffic to another port; EtherPeek NX supports multiple simultaneous captures from multiple NICs thus allowing the analyzer to capture both traffic streams. After these captures are taken, you may then utilize the “PeekCat” (fully described in the user manual) to merge the tracefiles together based on system time of the EtherPeek NX machine. The second method is to mirror both ports to a faster port on the same switch. Take a 100 Full Duplex port and mirror it to a Gig Port with a Gig analyzer.

EtherPeek NX supports gig capture with a gigabit NIC or for faster networks you will find GigaPeek NX fully able to support your needs with all the features you’ve come to love with EtherPeek NX!