Performance considerations when capturing
As we alluded to in the previous section, once the data rates start to go up, capturing packets can impact a host, even if it's a higher-end Linux host or VM. There are also some network decisions to make when you are setting up for a packet capture.
Factors to consider include the following:
- If you are using a SPAN or Monitor port, depending on the switch model, your destination port (the one your sniffer station is plugged into) may not be on the network – it might only see the traffic to and from the source. What this means is that often, you must use your fastest onboard NIC for packet capturing, and then use a lower performance USB NIC if that host needs to be active on the network at the same time (for instance, if you are remoting to it).
- In all cases, ensure that your NIC is fast enough to actually "see" all of the target packets. Especially in a monitor port setup, you can configure a 10 Gbps source...