Ethereal-users: [Ethereal-users] Ethereal very slow when monitoring a spanned port

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Suhrstedt, Tom" <tsuhrstedt@xxxxxxxxxx>
Date: Mon, 7 May 2001 12:46:55 -0400
I downloaded the 0.8.17 and the latest WinPcap and successfully ran
Ethereal on Win2K machines to monitor the normal traffic on the network
port of a PC (with 256 Mbytes memory) with good performance, even with
real time display and scrolling. I was impressed.

However, when I try to span traffic from a Cisco 5505 switch port to the
PC's port, I get very slow performance for anything (including Ethereal)
on that PC, with extremely long times to move or resize a window or
refresh the display and Ethereal will sometimes just hang.  Even if I
disable real time display and scrolling and just do a capture things are
very slow, and it will take about ten minutes to load about 800 packets
into the display after the capture has been stopped. I got the same
behavior whether I used a laptop or a tower PC using different NIC
cards.

This happens even if I span the traffic from only one port, so it seems
like it has something to do with spanning and promiscutiy more that the
traffic volume.  I know this is beta software, but was hoping that
someone could confirm this behavior or point out the error of my ways. 

Many thanks.
---
Tom Suhrstedt