0

Edit: Our server is trying to capture packets at between 500-600Mb/s, but is dropping packets 'due to kernel'.

Data is being written to SSDs, and isn't bottleneck there.

What things should I look for in a network card when choosing one that would be capable of handlind this kind of volume?

Not looking for product recommendations. Just advice on underlying technologies.

Thanks

BIGMOOSE
  • 9
  • 2
  • 1
    If you don't quantify this it can't possibly be answered. `A tonne` isn't quantitative; if you mean, eg, "*capture packets at 1Gb wireline speed*", please say so. This is also perilously close to a request for product recommendations, which are off-topic for ServerFault (and all SE sites); it's only the last sentence that saves it from a close vote from me. If it does get closed, don't take it personally, but please do read the help documents on what questions are permissible before posting again. – MadHatter Nov 15 '13 at 08:23
  • Thanks MadHatter. I'll reword the question to have it make more sense. – BIGMOOSE Nov 15 '13 at 09:05
  • reworded original question, as per MadHatters advice! – BIGMOOSE Nov 15 '13 at 09:07
  • Much better! But it would also be interesting to see what you maen by "*due to kernel*". If there are logs about dropped packets, can you paste a few in? If not, could you tell us why you think it's a kernel issue? OS details would be useful, too, in case there are OS-specific issues to address. – MadHatter Nov 15 '13 at 09:47
  • I think based on Tonnys advice below, the bottleneck is the mobo based NIC I'm using, it's advertised at 1Gb throughput, but on stress testing it, only achieved half of that (with other components performing ok). thank you for your advice anyway! – BIGMOOSE Nov 15 '13 at 15:21
  • Glad to hear you have an answer you're happy with! In case you don't know, local etiquette is that you accept it by clicking the "tick" outline; this drives the SF reputation system for both you and the author of the answer. My apologies if you already know this. – MadHatter Nov 15 '13 at 15:41

1 Answers1

0

You will need a NIC with a PCI-e interface or a PCI-X. And it has to have a Intel or Broadcom gigabit chipset (or 10 Gb of course). Some (recent) Atheros chipsets work well too. The hardware design of other brands of chipsets just isn't up to it.
If you are using on-board adapters check the motherboard documentation how these hook up to the bus. I have seen slightly older server-boards that used PCI for the on-board NIC's even though the motherboard was PCI-e.

If you run on Windows you can try to use Microsoft own NetWork Monitor (netmon) tool to capture the traces. (Output is compatible with WireShark). Netmon integrates closer with the OS than WinPCap which is used by WireShark and may give you a little more throughput.

Anyway: 0% packet loss doesn't exist. Due to the x86 architecture and the way the Windows kernel works you will see a lost packet sometimes. It just can't guarantee the delivery of every IO packet that comes through the hardware.
(That is one of the reasons that high-end network monitor devices are so bloody expensive. They need very special hardware and a custom OS to make guaranteed wire-speed capturing at any speed possible.)

I run regular 1 Gb/s captures at wirespeed for several hours at a time.
I don't need to see realtime what is captured. That really helps in keeping the capture performance up. The GUI would really slow things down.
I use a medium spec workstation PC (First generation Core-i7, 32G RAM, Win7 64-bit) with SAS disk (not SSD).
Netmon gives me slightly better captures then WinPCap (About 1 dropped packet per minute, versus about 1.3 packets/minute.)

Tonny
  • 6,332
  • 1
  • 18
  • 31