Tip of the Month

December 2004

Healthy Monitoring – Sliced Packets

Analyzers are easily overwhelmed in environments that generate large amounts of traffic. Networks running Full Duplex Gigabit can fill the default buffer within a matter of few seconds leaving you little or no time to capture and analyze the traffic. A quick solution might be to increase the capture buffer size. This will leave you with a capture with thousands of packets leading to longer troubleshooting and problem resolution times.

With Packet Slicing, valuable time and resources can be saved by analyzing the portion of the packet that you are interested in resulting in smaller packet sizes and more packets per capture as the payload is dropped while retaining the packet headers. Slicing values are defined in multiples of 4 bytes starting as low as 16 bytes on the GAC (Gigabit Analyzer Card). The 16 byte minimum enables you to capture the source and destination addresses, type/length fields for ordinary Ethernet packets and VLAN tags, if any, for 802.1Q/802.3ac tagged packets. We suggest keeping the slice length at 128 bytes by default to enable capturing all header information and little or no payload information. These values should be equal on both channels for connecting to a network tap to view full duplex traffic analysis.

Packet Slicing, however, is not applicable where the higher level protocol headers have random occurrence patterns within the lower level protocol frames. (Example: X Windows). Effective Packet Slicing depends on the selection of the capture interface. A NIC that will let you perform onboard processing for slicing and filtering, and therefore “actually” capturing at line rate will be more efficient than a NIC that needs to transfer packets to the PC before any processing is done. Within WildPackets GigaPeek NX, slice lengths and affected channel options can be configured under Capture Options > Hardware Filters and further customized by adding address filters to narrow down on problems.

WildPackets GigaPeek NX together with the GAC is specially designed for high traffic load environments that can be configured to slice and filter packets as desired by you.