Is Winpcap able to capture all packets going through a Gigabit NIC without missing any packets?
Posted
by
Patrick L
on Server Fault
See other posts from Server Fault
or by Patrick L
Published on 2012-06-30T05:57:35Z
Indexed on
2012/06/30
9:17 UTC
Read the original article
Hit count: 287
I want to use Winpcap to capture all network packets going through a Gigabit NIC of a server.
Assuming that I am able to utilize the network link up to 100%, the maximum network speed is 1000Mbps. If we exclude the TCP/IP headers, the maximum TCP data rate should be roughly 940Mbps.
Let's say I send a 1GB file through the NIC at 940Mbps using TCP destination port 6000. I use Winpcap to capture all network packets going through the NIC and then dump it to a pcap file. If I use Wireshark to analyze the pcap file and then check the sum of packet size for all network packets sent to TCP port 6000, am I able to get exactly 1GB from the pcap file?
Thanks.
© Server Fault or respective owner
