Wireshark-users: Re: [Wireshark-users] Query about capturing on Broadcom BMC5708C

From: Andrew Hood <ajhood@xxxxxxxxx>
Date: Mon, 05 Jan 2009 23:33:07 +1100

Gianluca Varenni wrote:
> Does the card have TOE (TCP Offloading Engine), also known as TCP Chimney? 
> If that's the case, and Chimney is enabled, you won't be able to capture the 
> TCP stream because the traffic goes directly from the TCP/IP protocol driver 
> to the card (thru a "chimney"), and WinPcap (the capture engine used by 
> Wireshark) cannot capture such traffic.
> 
> If that's the case, the only workaround is disabling Chimney on such network 
> adapter.

A quick Google search found various complaints about chimney screwing up
several products, most of them referencing Broadcom NICs. They all
recommended:

netsh int ip set chimney disable

or replacing the NICs with some from another manufacturer. As "Microsoft
Windows Server 2003 Scalable Networking Pack"
http://support.microsoft.com/kb/912222 is integrated into R2, switching
NICs may no longer work.

Sure enough, Wireshark now works.

I can also add Tivoli's Framework to the list, because disabling chimney
fixed that too.

> Have a nice day

Once I had the right command to "fix" the NIC we did. :)

-- 
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who