TurboCap Frequently Asked Questions
- What is TurboCap?
- When using Polling Mode, what timestamp granularity can generally be expected? I imagine that it is system-dependent, but can you give me some numbers?
- The TurboCap User’s Guide mentions that the Polling Mode method “causes high CPU usage as 1 CPU is running a busy-wait loop to timestamp the packets.” The way this is worded makes me wonder if this timestamping loop is executing on a different thread and therefore can possibly be assigned to a different process for improved packet processing performance?
- In the TurboCap User’s Guide, you state (when the driver is NOT is Polling Mode): “timestamps are generated periodically … using a 1 ms precise timer.” I interpret that as batches of packets are given timestamps at 1ms intervals. But when capturing the worst case scenario of 64-byte packets at full line rate, there will be nearly 1500 packets in one of those 1ms batches. Are they all given the same timestamp or is there something else going on?
- Can you give me more information on nanosecond timestamps?
- Is there any way we can use GPS-enabled local time server with TurboCap to timestamp packets?
- Regarding pass-thru mode, does TurboCap pass all frames, including those with FCS errors?
- Does the latest version of Wireshark natively display per-packet errors when used with TurboCap? Or is custom programming required to achieve this goal?
- If TurboCap is installed on Windows XP, can Wireshark capture and display Ethernet frames containing FCS errors? Or are those bad frames invisible to Wireshark? Similarly, if TurboCap is being used in pass-thru mode, are incoming frames containing FCS errors injected out the other port? Or are bad frames discarded by TurboCap in pass-thru mode?
- Are there additional source code examples for TurboCap? Specifically, I’ve been playing around with the ‘HiPerfPktReceiver’ sample and was hoping you might have some examples with more involved packet inspection & manipulation.
- Is it possible to have Full Line Rate Capture up to 1Gbps. Is it possible to get 2 Gbps on the same card with TurboCap?
- Can I get source code for TcDump?
- With TurboCap, can I dynamically change the filter IP without losing packets? For example, I filter first for Radius Packets. When I find an IP of interest, I then add that to my filter list and then filter for Radius and the specific IP. And so on and so on. Basically, I need to add filters on the fly.
- Can TurboCap do full line rate capture? If so, is there anything special I need to know to make this happen?
- What is a recommended platform for TurboCap? What size drive? What RAID level? What speed SATA Drives (7.2, 10 or 15K)?
- We have a Dell Optiplex 775 with a PCI-E x16 slot. We've been running an Intel PRO/1000 PT Quad port PCI-E NIC in this slot for awhile with no issues, although it does say on the spec sheet that it is compatible with x16 slots. I'm not sure how to tell if the motherboard is running the slot at x16 or x4 when the intel card in there, as it was my understanding that the PCI-E standard allowed cards of a lower speed to run in slots of a higher speed.
- Is the TurboCap solution able to operate in a way that makes it appear that it's not even there?
- Will TurboCap support a quad core configuration (total of 8 cores per server)?
- The API section of the TurboCap manual states that there are ways to specify timestamp mode, non-timestamp, polling mode, and timer mode. Is there any flag or specific value to check to discover which mode is currently running? Is there any way to change the mode between polling mode and the timer one? Any value I can change to control the mode?
- We installed our TurboCap card into an 4x PCIe slot, installed the drivers, and everything has been working fine. However, one thing that I have noticed is that, with the TurboCap drivers enabled, one of the two CPUs on the Core2 Duo is pegged at 100% usage. If I disable the drivers in device manager, then the CPU usage comes back down to 1-2% idle as expected on a normal system.
- Is your TurboCap 2-port NIC capable of capturing from 2 separate LANs?
- Is TurboCap supported under Windows 2003 Server?
- Will TurboCap work with network protocol analyzers other than Wireshark?
- How do you replay data at various speeds or close to line rate with TurboCap? I had a look in the user guide but there are no instructions for replaying data.
- With TurboCap, I have noticed that for large volume transmissions at approx 750Mbps we are experiencing a loss of 0.2% packet loss. Is this normal? We are using a PCIe 4x slot. What are the minimum specifications for 100% packet capture?
- Tcdump works well at dumping to disk with TurboCap, but is there any option of dividing up files when collecting so that I do not end up with a huge file? And when I do integrated collection via Wireshark, a large number of packet losses occur. Are there any special settings to circumvent this problem?
- Is TurboCap compatible with PCI Express 16x?
- Is there some kind of C# wrapper for the TurboCap API?
- Is there any Linux device driver available for TurboCap?
- We are building a data collection PC for our security audits and TurboCap is something we are considering. In the “Software Requirements” section of your datasheet it says TurboCap is supported under Vista 64bit AMD64 . Is it not supported with an Intel 64-bit processor? We have a quad-core shuttle as our target platform. We also need this with a fiber interface since most of the uplinks we’d like to tap are fiber. If I purchase the TurboCap and add a 2nd Intel NIC that is dual Fiber, is that supported?
- Please tell me how to get the TurboCap NIC to operate in aggregate mode or as two separate input ports. I didn’t see anything about it in the Control Panel.
- I would like to receive packets from the same port with TurboCap.Can I create 2 capture instances on the same port with and receive packets from the different 2 instances? Will this cause performance problems?
- What is the difference between TcDump.exe and TcDump_ng.exe? Is the dump file format available?
- Is it possible to have more than one TurboCap on one motherboard?
- Is there a compiled version of devpack samples for TurboCap?
- How does turbocap's native API support the filter grammar of pcap ? I can't see any native API resource to support pcap filter. Should I write filter code into my own application?
- We have a TurboCap capture card (running in gigabit pass thru mode) and today we noticed that when you ping through the capture card the latency is about 5 msecs (total round-trip time). Is this normal or is something wrong with our card? This much latency seems unusual to us and could significantly reduce TCP throughput while capturing.
- Is the TurboCap driver compatible with libpcap?
- We would like to use the pass-thru mode of operation to allow all traffic to pass unaltered. Is it possible to configure the TurboCap to allow pass-thru in hardware rather than in the driver?
- Currently we are only interested in capturing on 100Mb networks with TurboCap. Will this have any (positive) impact on the timestamping accuracy?
- When using Wireshark with TurboCap, is Wireshark in control of the actual starting and stopping of the captures?
- Does this also support the Wireshark capture filter, thus limiting the actual data captured and stored to disk (depending on filter settings)?
- When installing Wireshark, it automatically installs WinPcap, does this mean that we need a special version of Wireshark to interface with the TurboCap driver?
- I am looking for a product that will allow me to capture the packet inter-arrival times of a packet stream of up to 4000 packets per second to a precision of 100 nanoseconds or smaller. This is for network analysis for Timing Over Packet technologies. Can you tell me if this level of precision is achievable with TurboCap?
- Our vendor brought in a PC with TurboCap installed to get some network captures. We need to know if it is possible to apply filters to a TurboCap as the last trace was 10GB!
- I just used the TCDump while in the TurboCap directory. Is there an app in there that writes to disk?
- I am capturing packets on a 1GbE LAN. It states in the user guide for high speeds to use the dump to disk utility via tcdump. This works well, but it seems to keep everything in one file. Can tcdump use all the same commands as tcpdump?
- Any plans to make TurboCap work in laptops? I am a consultant for a software company and travel to various companies troubleshooting client/server applications. It is difficult to transport a desktop although I guess we could ship out a workstation.
- We are also looking for a solution internal on our GbE back end. Does TurboCap support fiber back end?
- When we run Wireshark on a server on a GbE switch, we see a lot of Retransmissions and Dup Acks. Could this be caused by running Wireshark natively on the server? Will Turbocap resolve this issue?
- Can both TurboCap ports be used to transmit at the same time (i.e., 2 Gb/s combined outgoing rate)? What is the host CPU utilization (ballpark) when sending at the max packet rate (assuming modern dual-core Intel or AMD CPU)?
- Can TurboCap transmit application packets (rather than just receive), and what is the maximum rate in packets per second? Specifically, can it saturate 1 GB using 40-byte packets?
- What type of interface does TurboCap provide to the OS/application (i.e., how does one receive/send packets from a program)? If this is normal winsock, then the system is likely to choke at the OS level unless interrupts are delayed significantly by the card. Regular Intel cards generate 4000-8000 interrupts/sec and this takes 100% CPU in both Windows Server 2003 and 2008. From my experience, winpcap doesn't do much better and has the same problem.
- Are the drivers available for 64-bit Server 2008?
TurboCap is a feature-rich, full-rate, Gigabit Ethernet capture and injection solution available for the Windows and Linux platforms. Based on a either a dual-port or quad-port Gigabit Ethernet board, TurboCap comes with an optimized driver that supports full-rate Gigabit capture and injection and is fully integrated with WinPcap/libpcap and, consequently, supports open source applications like Wireshark®, Windump, tcpdump and Ntop.
When using Polling Mode, what timestamp granularity can generally be expected? I imagine that it is system-dependent, but can you give me some numbers?
The granularity is on the order of several microseconds (3-5 micro seconds).
The TurboCap User’s Guide mentions that the Polling Mode method “causes high CPU usage as 1 CPU is running a busy-wait loop to timestamp the packets.” The way this is worded makes me wonder if this timestamping loop is executing on a different thread and therefore can possibly be assigned to a different process for improved packet processing performance?
The timestamping/capturing loop runs on a thread that is bound to one CPU (the last one in the system, with the current version of the driver).
In the TurboCap User’s Guide, you state (when the driver is NOT is Polling Mode): “timestamps are generated periodically … using a 1 ms precise timer.” I interpret that as batches of packets are given timestamps at 1ms intervals. But when capturing the worst case scenario of 64-byte packets at full line rate, there will be nearly 1500 packets in one of those 1ms batches. Are they all given the same timestamp or is there something else going on?
They are all given the same timestamp.
Packets are timestamped in software when they are received by the host. Although the resolution that we use in the timestamp provided with each packet is nanosecond, the actual precision in Polling Mode is on the order of several (3-5) microseconds, and depends on a number of factors (including the CPU load on the machine). This is valid as long as you use the polling timestamping mode. If you use the “timer” timestamping mode, the precision is around 1ms.
Yes, packets with FCS errors are passed.
Does the latest version of Wireshark natively display per-packet errors when used with TurboCap? Or is custom programming required to achieve this goal?
If you choose the Per-Packet-Information (PPI) linktype in the Wireshark capture options, then Wireshark will natively display per-packet errors when used with TurboCap.
If TurboCap is installed on Windows XP, can Wireshark capture and display Ethernet frames containing FCS errors? Or are those bad frames invisible to Wireshark? Similarly, if TurboCap is being used in pass-thru mode, are incoming frames containing FCS errors injected out the other port? Or are bad frames discarded by TurboCap in pass-thru mode?
TurboCap captures packets with correct and wrong FCS, and the FCS is always available to capturing applications. TurboCap also returns the following errors (on a per-packet basis):
- invalid Frame Check Sequence (FCS)
- sequence error. A valid delimiter sequence consists of Idle->start-of-frame(SOF) ->data,
- >pad(optional) – >end-of-frame(EOF) ->fill(optional) ->idle
- symbol error
- data error
Please understand that, if you are currently using WinPcap to receive packets, by default WinPcap will return packets captured with
TurboCap as bare Ethernet packets with the FCS, but it will not return the above mentioned errors.
If you want per-packet errors, you will need to slightly modify your application to:
1) receive packets encapsulated in PPI. PPI (Per Packet Information) is a header that gets prepended to
every packet and contains meta information like the errors and the frame check sequence presence.
2) make your packet dissection code take PPI into consideration.
Alternatively, you can switch your application to make use of the TurboCap native API that exposes all the features of TurboCap.
Are there additional source code examples for TurboCap? Specifically, I’ve been playing around with the ‘HiPerfPktReceiver’ sample and was hoping you might have some examples with more involved packet inspection & manipulation.
The TurboCap Developer's Pack doesn't ship with any examples of how to dissect packets. There are some examples of simple packet dissection in the WinPcap Developer's Pack, however, available at http://www.winpcap.org/devel.htm.
Is it possible to have Full Line Rate Capture up to 1Gbps. Is it possible to get 2 Gbps on the same card with TurboCap?
Yes.
With TurboCap, can I dynamically change the filter IP without losing packets? For example, I filter first for Radius Packets. When I find an IP of interest, I then add that to my filter list and then filter for Radius and the specific IP. And so on and so on. Basically, I need to add filters on the fly.
Filtering, at the moment, is implemented in user mode through the WinPcap API. You can change the filter on the fly using pcap_setfilter.
Can TurboCap do full line rate capture? If so, is there anything special I need to know to make this happen?
Yes, TurboCap can do full line rate capture if used with at least 4 PCIe lanes.
What is a recommended platform for TurboCap? What size drive? What RAID level? What speed SATA Drives (7.2, 10 or 15K)?
A Pentium-D (dual core) 2.8GHz CPU, 2GB RAM, 50MB free disk space on the hard drive plus additional space for capture (trace) files. Disk performance is key to full-rate packet dump to disk. A PCI-Express 4x or 8x slot with 4 lanes for the TurboCap adapter. Our test platform has six 250GB, 7200rpm HDD with SATA RAID0 (i.e. striping).
We have a Dell Optiplex 775 with a PCI-E x16 slot. We've been running an Intel PRO/1000 PT Quad port PCI-E NIC in this slot for awhile with no issues,
although it does say on the spec sheet that it is compatible with x16 slots.
I'm not sure how to tell if the motherboard is running the slot at x16 or x4 when the intel card in there, as it was my understanding that the PCI-E standard allowed cards of a lower speed to run in slots of a higher speed.
Your documentation says that the Turbocap NIC cannot run in an x16 graphics PCI-E slot.
Is this the case for all x16 graphics slots, or does the fact that our Intel PRO 1000 PT runs in it mean that the Turbocap NIC will run in it as well?
The problem with 16x graphic slots is that, in some cases, the board will not use 4 lanes (since TurboCap is a PCIe 4x card) but instead it will just use 1 lane. The card will work, but will not be able to go full speed. We have asked Intel about this, and they have stated that this is "normal". The 16x slot is made specifically for graphics cards (in fact it's called PEG, PCI Express Graphics) and works at 16x only with graphics cards.
If you have a PCIe 16x Intel card already installed in the slot, you can probably get the negotiated PCIe link width if you have installed the Intel driver + Intel PROSet for Windows Device Manager (it comes with the Intel cards). In order to determine this, go to the device manager: right-click on my computer, click properties, then go to "hardware" tab and click on "Device manager" (Windows XP) or click on "Device manager" on the left (Windows Vista).
Expand the "network adapters" item. You should have four items, one for each port of your QuadPort 1000/PT card. Right click on one of them, choose properties. Go to the "Link Speed" tab, and click on "identify adapter". The new dialog will give you the negotiated PCIe link width. If you don't have the "Link Speed" tab, it means that you just installed the drivers without the Intel PROSet for Windows Device manager.
TurboCap acts as a switch with the 2 ports operating at the same speed, so the answer to your question is “yes”.
A dual core processor is strongly suggested as a minimum requirement, but the software will definitely work (even better in some scenarios) on a machine with 8 cores.
The API section of the TurboCap manual states that there are ways to specify timestamp mode, non-timestamp, polling mode, and timer mode. Is there any flag or specific value to check to discover which mode is currently running? Is there any way to change the mode between polling mode and the timer one? Any value I can change to control the mode?
At the moment, the only way to check which timestamping mode is in use is through the TurboCap Control Panel. Future versions of the TurboCap API (but maybe not the next one) will have a flag allowing you to change and query the timestamping mode programmatically.
We installed our TurboCap card into an 4x PCIe slot, installed the drivers, and everything has been working fine. However, one thing that I have noticed is that, with the TurboCap drivers enabled, one of the two CPUs on the Core2 Duo is pegged at 100% usage. If I disable the drivers in device manager, then the CPU usage comes back down to 1-2% idle as expected on a normal system.
My question is, is this correct behavior? We weren't actually capturing data at the time, just had the card and drivers installed. I just wanted to make sure that this is the expected behavior, and that we have everything installed properly. This is on an x86 machine running 32 bit Windows XP SP3.
That is the correct behavior. The TurboCap driver uses all of the CPU to operate correctly. The current version of the driver "steals" a CPU even when no capture is in progress. The next version of the driver will steal the CPU only when you start a capture with TurboCap.
Yes, TurboCap supports capturing on 2 separate LANs because it has 2 separate Ethernet ports that work independently.
Officially, TurboCap supports XP, Vista and Windows 7 only. In practice, we've been successfully using it on Windows Server 2003 in-house without any problem.
For live capture from a TurboCap port directly to another party analyzer, the analyzer must be based on WinPcap. Otherwise,the third party analyzer must support the pcap file format to read a trace file created by TurboCap.
How do you replay data at various speeds or close to line rate with TurboCap? I had a look in the user guide but there are no instructions for replaying data.
At the moment, we do not have any tool to replay a capture file with TurboCap. However, in the TurboCap Developer’s Pack (available from http://www.cacetech.com/downloads.html), you can find a sample called HighSpeedTransmitter that allows you to transmit packets at the maximum packet rate. It's not possible to transmit packets at a specified rate because TurboCap does not support scheduled transmission of packets.
With TurboCap, I have noticed that for large volume transmissions at approx 750Mbps we are experiencing a loss of 0.2% packet loss. Is this normal? We are using a PCIe 4x slot. What are the minimum specifications for 100% packet capture?
TurboCap can do full rate if used in a PCIe slot wired with at least 4 lanes. Regarding the disk, we do not have a minimum specification for the HDD (or bus). In our own tests, we use a HW SATA RAID controller from Adaptec (PCIe 4x), connected to 6 SATA hard drives.
Tcdump works well at dumping to disk with TurboCap, but is there any option of dividing up files when collecting so that I do not end up with a huge file? And when I do integrated collection via Wireshark, a large number of packet losses occur. Are there any special settings to circumvent this problem?
Wireshark and tcdump dump packets to disk when capturing. If the disk is not fast enough, you can definitely lose packets, and the behavior during the packet loss can be unpredictable, especially when the capture is done with Wireshark. This is because:
1. Wireshark decodes packets while capturing (this actually depends on how Wireshark has been configured)
2. Wireshark uses the normal FILE APIs to dump to disk. These make use of the OS file system caching (tcdump disables file system caching for the dump file for the duration of the capture). Caching can impact the overall capture performance.
If you are not using a RAID unit, we suggest:
1. Dump to a separate disk (not a different partition, a completely separate disk).
2. Reboot the machine after the two tests (tcdump/wireshark) in order to wipe out the OS file system cache.
Tcdump can capture multi gigabyte files with no issue. The limitation is just the amount of free space on the HD. In our tests, we usually have 30-40GB files ( we dump a saturated 1Gbps link to a RAID system for long periods of time). If you would like to use an alternate capture utility that parses the data into files, you can use dumpcap: http://www.wireshark.org/docs/man-pages/dumpcap.html.
Yes, if the slot is a standard 16x one. Several motherboards have a 16x slot reserved for graphics (usually called PEG, PCI Express Graphics). If you put the TurboCap card (or any other non graphics card) in that slot, it will typically operate at 1x. This is not a limitation of the TurboCap card, but rather a "limitation/feature" of the motherboard itself.
Yes! A Fedora Linux driver is available on our Downloads page.
We are building a data collection PC for our security audits and TurboCap is something we are considering. In the “Software Requirements” section of your datasheet it says TurboCap is supported under Vista 64bit AMD64 . Is it not supported with an Intel 64-bit processor? We have a quad-core shuttle as our target platform. We also need this with a fiber interface since most of the uplinks we’d like to tap are fiber. If I purchase the TurboCap and add a 2nd Intel NIC that is dual Fiber, is that supported?
AMD64 (also called EM64T or x64) means that we support 64bit processors in the AMD family, as well as 64bit x64 processors from Intel (i.e., all the Intel processors sold in current PCs). The only processor that we do not support is the Itanium.
Regarding the use of a fiber card, the TurboCap driver supports the Intel card provided with the TurboCap package. If you need to use TurboCap on a fiber link, you will need to buy a fiber to copper adapter.
Please tell me how to get the TurboCap NIC to operate in aggregate mode or as two separate input ports. I didn’t see anything about it in the Control Panel.
You don't need to configure anything to use the aggregate mode - it's always enabled (that's why there is nothing related to it in the Control Panel). For example, Wireshark and tcdump will list both the separate ports and the board aggregating port. If you want to work in aggregation mode, i.e., capture from both the physical ports at the same time, please choose the port called Board Aggregating Port, as shown on page 16 of the TurboCap User's Guide.
I would like to receive packets from the same port with TurboCap.Can I create 2 capture instances on the same port with and receive packets from the different 2 instances? Will this cause performance problems?
It's definitely possible to create two instances capturing from the same port, they will receive the same traffic. As far as performance is concerned, it basically depends on what you do with the packets, but it shouldn't cause problems (not more than opening one single instance and then duplicating to two different processing paths in your application).
TcDump.exe is the old libpcap format (Ethernet only). TcDump_ng.exe is the new pcap ng file format recently developed here that allows mixing of wired and wireless packets,
annotation of packets and more. The dump file format is available at:
http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
No, at the moment we do not ship the compiled version of the samples. We can provide them if you need them, though. Just send a request to info@cacetech.com.
How does turbocap's native API support the filter grammar of pcap ? I can't see any native API resource to support pcap filter. Should I write filter code into my own application? Something like this?
pcap_compile_nopcap (snaplen_arg, linktype_arg, program, buf, optimize, mask);
const struct pcap_pkthdr *header;
const u_char *pkt_data;
//fetch packet using TcInstanceReceivePackets &&
// TcPacketsBufferQueryNextPacket
if(pcap_offline_filter(program, header, pkt_data))
process this packet;
else
discard this packet;
Is this the best way to filter with TurboCap's native API?
At the moment there is no native TurboCap API to filter packets, and the easiest way to filter them is the one that you have proposed. Future versions of TurboCap might support filtering.
We have a TurboCap capture card (running in gigabit pass thru mode) and today we noticed that when you ping through the capture card the latency is about 5 msecs (total round-trip time). Is this normal or is something wrong with our card? This much latency seems unusual to us and could significantly reduce TCP throughput while capturing.
5ms is definitely too high. Did you set the timestamping mode to polling mode? If not, please switch to polling mode. The latency should improve significantly and, in switching to polling mode, you will not increase the likelihood of dropping any packets that pass through the card.
The driver is compatible with WinPcap which is compatible with libpcap (but it's Windows).
We would like to use the pass-thru mode of operation to allow all traffic to pass unaltered. Is it possible to configure the TurboCap to allow pass-thru in hardware rather than in the driver?
No. The board does not support hardware pass-thru.
Currently we are only interested in capturing on 100Mb networks with TurboCap. Will this have any (positive) impact on the timestamping accuracy?
The CPU load is definitely lower in this case, so the jitter in the generated timestamps is expected to be lower.
When using Wireshark with TurboCap, is Wireshark in control of the actual starting and stopping of the captures?
The capture starts when you hit the start button on Wireshark, and stops when you hit the stop button.
Does this also support the Wireshark capture filter, thus limiting the actual data captured and stored to disk (depending on filter settings)?
Yes, as long as you use the normal Ethernet encapsulation. If PPI encapsulation is used (e.g. to get the interface Id in case of aggregating ports), filtering is not supported.
When installing Wireshark, it automatically installs WinPcap, does this mean that we need a special version of Wireshark to interface with the TurboCap driver?
The version of Wireshark shipped with the TurboCap installation CD (v1.4) is the official Wireshark 1.2.5. Typically the latest version of Wireshark can be used with TurboCap as well. As far as WinPcap is concerned, TurboCap ships with the publicly available 4.1.1 build.
I am looking for a product that will allow me to capture the packet inter-arrival times of a packet stream of up to 4000 packets per second to a precision of 100 nanoseconds or smaller. This is for network analysis for Timing Over Packet technologies. Can you tell me if this level of precision is achievable with TurboCap?
We cannot guarantee such timestamp precision.
Our vendor brought in a PC with TurboCap installed to get some network captures. We need to know if it is possible to apply filters to a TurboCap as the last trace was 10GB!
There are no filtering capabilities *within* the driver, but it's possible to filter the captured traffic with the TcDump utility as well as with wireshark/tshark.
Usage: tcdump.exe filename [-f ] [-p ] [-e] [-s ]
filename name of the file to dump to
-f filter string, in the libpcap/tcpdump format (e.g. \"tcp port 80\")
-p name of the port to capture from.
-e when capturing from an aggregating port, save the ID of the physical ports for each packet.
-s save only the first bytes of each packet.
I just used the TCDump while in the TurboCap directory. Is there an app in there that writes to disk?
The TurboCap Software Distribution includes the TurboCap Windows Driver, Manuals, and a Developer’s Package. The Developer’s Package is for users who are interested in developing their own applications based on the TurboCap API and includes a large number of sample applications. One very important included application is “Dump-to-Disk”, which has been optimized for high-speed capture to disk.
I am capturing packets on a 1GbE LAN. It states in the user guide for high speeds to use the dump to disk utility via tcdump. This works well, but it seems to keep everything in one file. Can tcdump use all the same commands as tcpdump? I tried to pass a few but it was not working. I need to run a capture throughout the day via server side and that would create a huge file. I could spilt it with tshark after the fact, but I would rather have it create a pcap file every hour. I know we can use Wireshark but based on the user guide I am concerned that I might miss some packets going this route. Basically I am looking to do the following command via tcdump if possible:
dumpcap -p -i 3 -a files:8 -b duration:3600 -w %COMPUTERNAME%_dumpcap.pcap
A.
At the moment, tcdump doesn't offer any feature to split the capture into multiple files. We’re definitely considering adding this option, but need to address a couple of minor issues when switching from one file to another that could cause packet loss.
Any plans to make TurboCap work in laptops? I am a consultant for a software company and travel to various companies troubleshooting client/server applications. It is difficult to transport a desktop although I guess we could ship out a workstation.
Not with the current hardware. There's no Express Card or PCMCIA version of the card.
We are also looking for a solution internal on our GbE back end. Does TurboCap support fiber back end?
Not directly. You need to use a fiber to copper adapter for this.
When we run Wireshark on a server on a GbE switch, we see a lot of Retransmissions and Dup Acks. Could this be caused by running Wireshark natively on the server? Will Turbocap resolve this issue?
It's difficult to say why this happens. Running the sniffer application on the production server itself is not usually a good idea, because the server applications (e.g. apache or IIS) compete with the sniffer system for the CPU and, possibly, disk resources. It's always advisable to run the sniffer on a separate machine through the normal WinPcap or with a TurboCap card.
Can both TurboCap ports be used to transmit at the same time (i.e., 2 Gb/s combined outgoing rate)? What is the host CPU utilization (ballpark) when sending at the max packet rate (assuming modern dual-core Intel or AMD CPU)?
When transmitting on the two ports at the same time at full speed, the driver may or may not keep up, it depends on the hardware. On one of our test machines with an Intel dual core 2.8GHz CPU, our test application can generate more than 990Mbps with small packets. On another machine, with a quad core Xeon at 2.33GHz (running an x64 version of Windows), we transmit full rate.
The CPU utilization is a bit tricky. The TurboCap driver uses one CPU 100% in a polling loop. So what you see in the Task Manager is that the last CPU of the system is always 100% used. What actually happens is that the driver uses all the free cycles of that core to run the board. If a process needs that core, the OS will schedule a process on that core as well.
In the case above (transmitting small packets at 1Gbps), the CPU load for the transmission application *per port* is the following:
(Intel dual core 2.8GHz): around 50% of 1 core per transmitter
(Intel Quad Core Xeon 2.33GHz): around 20% of 1 core per transmitter.
Can TurboCap transmit application packets (rather than just receive), and what is the maximum rate in packets per second? Specifically, can it saturate 1 GB using 40-byte packets?
Yes. Depending on the specific hardware of the PC, it can saturate a 1Gbps link with small packets (64bytes Ethernet packets including FCS, around 1.5M packets/s).
What type of interface does TurboCap provide to the OS/application (i.e., how does one receive/send packets from a program)? If this is normal winsock, then the system is likely to choke at the OS level unless interrupts are delayed significantly by the card. Regular Intel cards generate 4000-8000 interrupts/sec and this takes 100% CPU in both Windows Server 2003 and 2008. From my experience, winpcap doesn't do much better and has the same problem.
There is a custom API to talk with the board. No sockets.
The driver supports both x86 and x64 machines (it does not support Itanium). Although the driver should work on Windows Server 2008, it's not a supported platform at the moment. The supported platforms are Windows 7, Windows Vista and Windows XP x86 and x64.