On Mon, Feb 16, 2009 at 12:35 AM, John A. Kilpatrick <john@hypergeek.net> wrote:
Has anyone had problems with using current Intel quad ethernet cards for packet capture? As a proof-of-concept test we bought an Intel PWLA8494GT and hooked it up to some Network Critical taps. There was a very strange issue with corruption of the captured packets. The *only* issue (but it's a big one) is that the source IP on some captured packets is munged. As far as I can tell that's the *only* issue with the packet captures - no other data is corrupted.
Dumb question... It sounds like you've only used the card in packet capture mode (i.e. promiscuous mode). Have you tried testing the card just for normal host-to-host network flows? Maybe you have a bad card? If you still see problems on host-host flows, it's more likely to be a bad card rather then a bad driver. (Given that a driver that can't handle host-host flows is going to be obvious pretty quickly.) Good Luck, Bill Bogstad