Net sniffers and traffic generators

Posted on 2001-06-06
Medium Priority
Last Modified: 2012-08-13

Is it possible to determine whether a net device is a software or a hardware router by sniffing the network? Which sniffers would do this? By the way, does anyone know of a software traffic generator  which can transmit up to 10 Mb/s? . Freeware or trials wanted. I admit this is a two-in-one question. If I get real gain from the answers, I will raise the points.

Question by:sanjiva

Expert Comment

ID: 6162192
I have an idea.. maybe it will be workable? :)
if ur sniffer in on the same network...
you can trace the IP to MAC address used to communicate between the router and other devices on the network.

The MAC or ethernet hardware address does include vendor specific ids.. so from there, u can deduce whether it is a server NIC card or router interfaces...
However, bear in mind that MAC address cna be spoofed or replaced with self-assigned MAC address on some Unix servers.

Expert Comment

ID: 6162700
Hai Sanjiva,
I really agree with Haho.  Only way you can identify from which machine you received packet(ie from router or from some other device) by observing the MAC address.  Every NIC manufacturer will have a unique ID for that company(ie first three bytes will be unique for each vendor).

But all the above is limited when you are using sniffer only in LAN.  Beacause the MAC address will change when you transfer the data from one LAN to another LAN through router or some other device.

There is another possibilty as told by Haho you can change the MAC addresses locally.  This is called as Locally Administered Address.  Now a days its possible with so many NIC drivers.

You can download software traffic generator demo versions from

In this search for traffic generator in pc downloads.

You will get the required one.

I hope I have given clear information.


Author Comment

ID: 6163252
Thanks Haho and Murthy,

I will not be able to try that immediately, but will let you know when I am.

It seems I am the one who has not been completely clear: there is a hardware device which performs the routing, it certainly is not a server. What I wonder is whether the routing implementation in this router is done in software ('slow path') or hardware ('fast path'). Modern routers should be implemented in the hardware, but I want to check if this is so.


Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.


Expert Comment

ID: 6163527
   Alll routing occurs in software.  The slow path/fast path that I think you are refing to is what cisco calls fast switching of the packet.  This is still done in software.

Process Switching

Process switching is the most basic way of handling a packet. The packet is placed in the queue corresponding to the Layer 3 protocol and then the
corresponding process is scheduled by the scheduler. The process is one of the processes you can see in the show process cpu command output (that
is, "ip input" for an IP packet). At this point, the packet will stay in the queue until the scheduler gives the CPU to the corresponding process. The waiting
time depends on the number of processes waiting to run and the number of packets waiting to be processed. The routing decision is then made based on
the routing table and the Address Resolution Protocol (ARP) cache. Once the routing decision has been made, the packet is forwarded to the
corresponding outgoing interface.

Fast Switching

Fast switching is an improvement over process-switching. In fast switching, the arrival of a packet triggers an interrupt, which causes the CPU to
postpone other tasks and handle the packet. The CPU immediately does a lookup in the fast cache table for the destination Layer 3 address. If it finds a
hit, it rewrites the header and forwards the packet to the corresponding interface (or its queue). If not, the packet is queued in the corresponding Layer 3
queue for process-switching.

The fast cache is a binary tree containing destination Layer 3 addresses with the corresponding Layer 2 address and outgoing interface. Since this is a
destination-based cache, load sharing is only done per destination. If the routing table has two equal cost paths for a destination network, there is one
entry in the fast-cache for each host.

Some packets/protocols cannot be fast-switched, such as X25, or packets destined to the CPU, like routing updates.

Accepted Solution

Haho earned 100 total points
ID: 6166225

or u can use a network mapper/monitoring tool that seems to be able to deduce what type of equipment on the LAN;


Author Comment

ID: 6177154
Murthy d,
I am sorry but I did not find what I am looking for on the link you suggested. I have 'scanned' about 50 downloads. Did you have a particular program in mind?

Thank you, I will try the net. monitor and let you know. Still, it is not what I need. I already am using net. monitors and also the manufacturer's tools for the network devices.
What I need is a generator of (meaningless) ethernet traffic, to load an experimental network with 'data'. Then, I want to add a voice over IP stream, give it a priority on specific ports of the network devices, and see the difference in the quality of the voice signal. To see this, the network must be very much loaded. If the traffic generator can do (allmost) 10 Mb/s, than I am sure the voice will be degraded untill it gets the priority.

A note on the primary question about hardware routers will follow.


Expert Comment

ID: 6192992

You must realize that 10Mbps is quite an amount of traffic.
I've used "sniffer pro" to generate a lot of traffic by sending the same packet each 0 (zero) milliseconds. It caused so much traffic that my NIC couldn't receive any more data and caused my system to hang after about 5 seconds.
However, I have never reached 10Mbps from one machine because the bus speed of my pc (an ordinary P4) can't handle all the traffic generated by the processor.
What you can do is generate multicast traffic and forward it to a layer 3 switch. From the layer 3 switch set up multiple routing ports to a layer 2 switch with each port (of the L3) in a different VLAN. Now trunk all of these VLANs back to one single port. This port will definitely have more than 10Mbps.
Please note that you need good processors on the switches because multicast traffic uses CPU and when your CPU hits 100% for all long time it will probably reboot. (I used a Nortel 8600 L3 and a Nortel Baystack 450)

Author Comment

ID: 6193078
Thank you for a very interesting idea. I will try it as soon as I can, but it might be as long as in 10-14 days as some routers/switches and myself will be away from the company in the meantime. However, I am looking forward to give this a try.

Expert Comment

ID: 6195494
1) A sniffer will provide the OUI (Organizationally unique identifier, commonly refered to as the Vendor ID) of the router if it is sitting on the same wire as the router.  Using this a certain amount of information can be gathered to give clues as to wether the router involved is software or hardware based.  Ultimatly what is the purpose of your question concerning the hardware vs. software basis of the router?  Are you attempting to determine what devices are performing routing functions in the network? Are you looking for a router that is contributing to routing loops or otherwise injecting bad route information? Are you concerned about the performance of a routing device, and therefore are attempting to derive how it is operating?

Post a comment regarding these questions and I'll certainly attempt to asist in providing some positive information for your problem.

2)The only free utility that I have used is at this url;

But the parent company has products specific to the testing that you are looking to do, look at ;

Obviously a for fee product a product that will definiatly provide the tools to provide the testing information that you are looking for...

Author Comment

ID: 6195597
Thanks for the effort. My aim is to confirm the performance level of a router which performs the routing in hardware. It is an Alcatel router, and I have got a clear explanation from the technical support about software/hardware routing, I just want to prove to the net. users the routing in this device is done through hardware.
As for the rest of your comment, I will do my best to try it soon, but please be patient! I will let you know as soon as I have any news. Thanks again.
LVL 79

Expert Comment

ID: 7803145
This question appears to be abandoned. I will allow one week before I close this question
with the following recommendation:

- points 3-way 25 each to haho, 3408, crieman

if there is any objection to this recommendation then please post it here within 7 days.


EE Cleanup Volunteer

Expert Comment

ID: 7865643
per recommendation

Community Support Moderator @Experts Exchange

3408 points for you at:

crieman points for you at:

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question