Wireshark · Ethereal-users: Re: [Ethereal-users] Capture with Gbps NIC

[Guy Harris <guy@xxxxxxxxxxxx>]

On Thursday, July 17, 2003, at 4:36 PM, Ian Schorr wrote:

> I'm assuming you're wanting to know if there is something general 
> about gigabit ethernet that would prevent promiscuous mode on <some 
> platform>.  I'm not aware of any general limitations of libpcap on any 
> platform that prevent promiscuous capture on, generally, gigabit NICs.

Or perhaps he wants to know whether capturing in promiscuous mode on a 
gigabit network would supply so much traffic that Ethereal would have a 
problem keeping up.  If so, the answer is probably "yes" if the wire is 
running at full speed.  Of course, promiscuous mode is only partially 
relevant to that; what really matters is the rate of traffic, but if 
you're on a gigabit hub, *if* such things exist, or if you're on a 
switched port that's been set up as a mirrored port, that means you 
could see more traffic than you'd see on a regular switched port (and, 
in fact, if you're on a mirrored switch port, you could see more 
traffic than will fit on the gigabit link between you and the switch, 
in which case the *switch* will drop packets that won't fit on the 
link).