Loosing Packets when mirroring a port

[mollardr1]

I was wondering if anyone is having any problems with Capsa Free Edition loosing packets when they try to mirror a port.

I have 2 NIC cards in my test machine that has Capsa on it. Card 1 i use to Remote in to the machine to look at the traffic. Card 2 is the card that i have mirrored to my desired port that i am wanting to sniff.

I was doing some testing the other day with a 90Mb file. When i am sniffing the mirrored port i am only recieving about 1/3 of the traffic from Card 2.

If I physically go to my test machine that has Capsa on it and Download the 90 Mb file i can see all all the traffic.

Any help would be great!

[Colasoft Support]

Hi mollardr1,

Thank you for choosing Capsa. What analysis profile (on the start page) did you use when you test?

[ibanezrg770]

Mollard1,
I am having a similar issue. Could you check and tell me if you are losing packets on the upload side. When I do tests, my download speed/size seems accurate but my upload only shows a fraction of the real speed/size.
What OS are you using? Colasoft worked fine for me on XP (32 bit) but I now have it installed on Windows 7 (64 bit). What NIC do you have installed? This computer has NVidia Nforce. I am just trying to see if there are any similarities. Tim

[mollardr1]

I have tried both the Full Analysis and Traffic Monitor and still produces the same result.

Tim, the system that i am running on right now is Windows 7(x86). NIC card is a D-Link DFETX+ ..... I have also switched it with a 3Com NIC card and neither one seems to help the situation.

When you said that your tests worked was that in Win7 or XP?

Rick

[ibanezrg770]

It worked with Windows XP, I am experiencing the problems with Windows 7.
Did you test and see if the missing packets were from the upload packets?

[mollardr1]

i did test to see if i was losing upload packets and that does not seem to be the problem.. I am capturing pretty much all of the packets being uploaded. Most all of my losses are from download side.

[ibanezrg770]

Well, I am wondering if it is a Windows 7 issue. We are both experiencing a similar issue, just on opposate traffic.
Just FYI for you, when I had the XP comp connected and working properly, it was on the same mirroring port of my switch. I don't think that the mirroring is the issue. Tim

[mollardr1]

i have been thinking on those lines as well. I am going to throw windows server 2008 on my test machine to see if there are any different results.

While testing on Win7 i thought that the card was not switching over to promiscuous mode while sniffing but this was not the case.

I will let you know what i find out with server 08.

Rick

[ibanezrg770]

I am going to do the same thing. I have 2 laptops, 1 Windows XP and the other is Windows 7. I am trying to get free versions for both and will test them out. Tim

[mollardr1]

Tim, when you were running xp were losing any packets that you could tell? If so about what percentage.

I loaded server 2008 and the results seem to be better. I am able to capture about 60-70% of the packets. i am going to mess around with the OS and other NIC cards to see if i can make it work a little better.

[ibanezrg770]

Rick,
It seemed when I was running it on XP it was pretty accurate. I have another program that monitors my firewall and takes samples once a minute and they were matching up very well.
Something I did notice tonight. Can you see if your bandwidth utilization meter is increasing when you run your test. When I do my upload test, the utilization meter goes up to 40-50% (40-50mbps) which is correct while the speed on the IP Endpoint page only shows 500kbps.
Tim

[mollardr1]

Tim,

My port Utilization meter does not seem to be moving very much at all. It only changes to about 2% but does not get any higher than that. The pps Meter seems to be working correctly and shows the right amount of packets coming across.

Rick

[hrj_email]

I test it in Several Switches like Cisco 3560 and Cisco 3750.
If you use SPAN or Mirroring you will encounter alot of packet loss and if your connection is a low bandwidth connection , you will encounter alot of trouble,

So I recommand that you use a HUB before your outside connection instead of using SPAN or Mirroring it works very well.

I test it in different enviroments and the result is great.

Thanks alot.

[brian_mi]

Can you share your test results here?