Loosing Packets when mirroring a port

I was wondering if anyone is having any problems with Capsa Free Edition loosing packets when they try to mirror a port.

I have 2 NIC cards in my test machine that has Capsa on it. Card 1 i use to Remote in to the machine to look at the traffic. Card 2 is the card that i have mirrored to my desired port that i am wanting to sniff.

I was doing some testing the other day with a 90Mb file. When i am sniffing the mirrored port i am only recieving about 1/3 of the traffic from Card 2.

If I physically go to my test machine that has Capsa on it and Download the 90 Mb file i can see all all the traffic.

Any help would be great!

 

Hi mollardr1,

Thank you for choosing Capsa. What analysis profile (on the start page) did you use when you test?

 

Mollard1,
I am having a similar issue. Could you check and tell me if you are losing packets on the upload side. When I do tests, my download speed/size seems accurate but my upload only shows a fraction of the real speed/size.
What OS are you using? Colasoft worked fine for me on XP (32 bit) but I now have it installed on Windows 7 (64 bit). What NIC do you have installed? This computer has NVidia Nforce. I am just trying to see if there are any similarities. Tim

 

I have tried both the Full Analysis and Traffic Monitor and still produces the same result.

Tim, the system that i am running on right now is Windows 7(x86). NIC card is a D-Link DFETX+ ..... I have also switched it with a 3Com NIC card and neither one seems to help the situation.

When you said that your tests worked was that in Win7 or XP?

Rick

 

It worked with Windows XP, I am experiencing the problems with Windows 7.
Did you test and see if the missing packets were from the upload packets?

 

i did test to see if i was losing upload packets and that does not seem to be the problem.. I am capturing pretty much all of the packets being uploaded. Most all of my losses are from download side.

 

Well, I am wondering if it is a Windows 7 issue. We are both experiencing a similar issue, just on opposate traffic.
Just FYI for you, when I had the XP comp connected and working properly, it was on the same mirroring port of my switch. I don't think that the mirroring is the issue. Tim

 

i have been thinking on those lines as well. I am going to throw windows server 2008 on my test machine to see if there are any different results.

While testing on Win7 i thought that the card was not switching over to promiscuous mode while sniffing but this was not the case.

I will let you know what i find out with server 08.

Rick

 

I am going to do the same thing. I have 2 laptops, 1 Windows XP and the other is Windows 7. I am trying to get free versions for both and will test them out. Tim

 

Tim, when you were running xp were losing any packets that you could tell? If so about what percentage.

I loaded server 2008 and the results seem to be better. I am able to capture about 60-70% of the packets. i am going to mess around with the OS and other NIC cards to see if i can make it work a little better.

 

Rick,
It seemed when I was running it on XP it was pretty accurate. I have another program that monitors my firewall and takes samples once a minute and they were matching up very well.
Something I did notice tonight. Can you see if your bandwidth utilization meter is increasing when you run your test. When I do my upload test, the utilization meter goes up to 40-50% (40-50mbps) which is correct while the speed on the IP Endpoint page only shows 500kbps.
Tim

 

Tim,

My port Utilization meter does not seem to be moving very much at all. It only changes to about 2% but does not get any higher than that. The pps Meter seems to be working correctly and shows the right amount of packets coming across.

Rick

 

I test it in Several Switches like Cisco 3560 and Cisco 3750.
If you use SPAN or Mirroring you will encounter alot of packet loss and if your connection is a low bandwidth connection , you will encounter alot of trouble,

So I recommand that you use a HUB before your outside connection instead of using SPAN or Mirroring it works very well.

I test it in different enviroments and the result is great.

Thanks alot.

 

Can you share your test results here?