HELP with gigabit sniffing 3

[Kekoa]

In the past I have just used my laptop to sniff 10/100 baseT traffic. Now that we have Gig to all of our servers and on our backbone I have a need to sniff out Gig problems. So I went and "borrowed" a 933, with 512 ram, 20 gig hard drive, yada yada yada...Now I am getting the feeling that the only way to sniff gig is by using either the Dolc box or buy purchasing one of NAI's dual channel Gig cards. I have no reason to use 2 channels, I am just going to listen to traffic that is received on a server. Please someone tell me that I CAN use just a single channel 64 PCI, 1000 SX GIG card.

(right now if I start snifpro45, it tells me failed to set monitor mode...and also flashes channel A and B link faults, obviously because I don't have channels A and B.)

 

[SpenceP]

The Sniffer is only designed to be used at Gigabit speeds with the NAI Gigabit analysis card. Because of the bottleneck of the PCI bus the Sniffer software is just not capable of wirespeed capture with a standard NIC. The NAI card, by using FPGA technology, is able to work at Full Duplex full line rate which is importany for Gigabit analysis, it also works at the 10bit layer so any auto-negotiation issues can be discovered.

Spencer P

 

[Kekoa]

Spencer P,

So your saying the only way sniff Gig with NAI Sniffer is to use NAI $20,000 dual channel Gig card?? This seems a bit ridiculous that NAI would provide a software that can only be used with a $20,000 NIC card!!! Am I understanding this right? I can't use a third party Gig NIC?

 

[wybnormal]

It's not ridiculous when you consider that they had to effectively engineer around a hardware limitation that normally would prevent any sniffing of Gig. While you may not know it but sometimes in order to sniff the datastream, you need a NIC that doesnt try to "follow the standards" for error control and the like. You need the card to accept ALL packets, valid or not and sometimes that requires rewriting the microcode on a NIC or tweaking the hardware. And since they are not selling millions of these cards, the cost per unit goes up a considerable amount. Not counting the "captured market effect"

Honestly, 20K for a full duplex gig card is one of the cheaper aspects of your gig backbone. Even more so when you figure out the cost per hour of downtime due to a network problem.

Mike S
"Diplomacy; the art of saying 'nice doggie' till you can find a rock" Wynn Catlin

 

[SpenceP]

Also don't forgot that if you software license is for Sniffer PRO LAN only, not Portable Analysis suite, then you are not licensed for use at Gigabit speeds. The design of the software is such that it detects the card is Gigabit and then tries to load it's internal gigabit drivers as it is the only supported Gigabit card.

Sniffer were first to market with a Gigabit Sniffing tool 2 years ago, and because these cards do not sell in high numbers the cost is still high compared to a gigabit NIC. Please bear in mind that this card is essentially a digital oscilloscope which is what allows it to see all of the 10-bit traffic. Try finding a PCI based digital oscilloscope for less than 20K!

Spencer P

 

[SpenceP]

Also don't forgot that if your software license is for Sniffer PRO LAN only, not Portable Analysis suite, then you are not licensed for use at Gigabit speeds. The design of the software is such that it detects the card is Gigabit and then tries to load it's internal gigabit drivers as it is the only supported Gigabit card.

Sniffer were first to market with a Gigabit Sniffing tool 2 years ago, and because these cards do not sell in high numbers the cost is still high compared to a gigabit NIC. Please bear in mind that this card is essentially a digital oscilloscope which is what allows it to see all of the 10-bit traffic. Try finding a PCI based digital oscilloscope for less than 20K!

Spencer P

 

[Kekoa]

Okay, you guys got me, thanks for the info!! I guess I will start mowing lawns and washing cars to save enough money purchase this card. JK : ) Thanks again!

 

[wybnormal]

Personally I find that a expresso cup with a sign, "will sniff for food" works well in the Silly Valley here in CA.
;-)

Mike S
"Diplomacy; the art of saying 'nice doggie' till you can find a rock" Wynn Catlin

 

[barniclebill]

There is a new solution available for Notebook Users and SnifferPro Portable Full Suite Software. It is called the UltraBook and Gigabit PHY. The Biggest benifit is that you can change from SX to LX using GBICS.. The Solution is still pretty expensive but eliminates the need for the $9K Dolch box you need to run the Gig PCI card. Give NAI a call and get some pricing.

 

[Sniffmaster]

Hi,
Barniclebill is right...Use Snifferbook Ultra with the Gig module. You also get realtime Expert during capture with Snifferbook Ultra from your laptop. With the PCI Gig card expert is post capture. Or use our new improved Gigabit distributed and the config options are many and you get RMON! And its more cost effective.
Go Sniffer!