Wireshark-users: Re: [Wireshark-users] Can This Be Done?
Date: Fri, 13 Apr 2007 13:54:52 -0700
No. The setup will appear to work, but of course the switch interface will 
be overwhelmed as soon as PC traffic goes above 100 MBits/s. To be 
technically accurate most switches will attempt to buffer the overflow 
which will average out traffic rates just above 100 Mbits. And of course 
you have the problem with duplex - your setup has 100 Mbits inbound, but 
it is (or should be) viewing inbound AND outbound traffic on a gigabit 
port - for 2 gigabits worth of potential traffic. Generally this duplex 
issue isn't a problem if your monitor and monitored ports are the same 
speed, but this configuration just won't work.

Given the price of gigabit adapters and ports it makes sense to upgrade 
your Wireshark PC.

Randy Grein
Network Engineer

"Tennis Smith" <[email protected]> 
Sent by: [email protected]
04/13/2007 01:39 PM
Please respond to
Community support list for Wireshark <[email protected]>

<[email protected]>

[Wireshark-users] Can This Be Done?

I have a wireshark pc with a 10/100 nic connected to a switch.  The port 
attached to the pc is getting data mirrored from a 1Gig port passing 
traffic.  So, in other words, the w/s pc is sniffing a port that could run 
as fast as 1gig (see below).
      1g           1g
In my case, there isn’t any need to capture data.  I only want to measure 
traffic rates. 
Can the wireshark pc accurately detect traffic rates on the PC1/PC2 
connection when speed exceeds 100mb?
-Tennis _______________________________________________
Wireshark-users mailing list
[email protected]

- -------------------------

CONFIDENTIALITY NOTICE: The information in this message may be proprietary and/or confidential, and is intended only for the use of the individual(s) to whom this email is addressed.  If you are not the intended recipient, you are hereby notified that any use, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to this email and deleting this email from your computer.  Nothing contained in this email or any attachment shall satisfy the requirements for contract formation or constitute an electronic signature.