Solved

Suitability of long term (ie: 24 hours) packet capturing on a production server

Posted on 2004-10-13
5
231 Views
Last Modified: 2010-04-10
Hi All,
Is it practical to leave Ethereal installed on a server capturing for an extended period (24Hrs+, I have around 200GB Available)?
What kind of performance hit would be expected for a dual xeon machine with SCSI drives and a gigabit network card?

Thanks in advance
0
Comment
Question by:jasef
5 Comments
 
LVL 70

Accepted Solution

by:
Chris Dent earned 150 total points
ID: 12296668
I've run Ethereal on a Honeypot machine for 5 days continuously in order to catch an instance of Nachi running on a rather large network.

I would recommend you apply Filters at point of capture, rather than on the captured data. This will reduce the total capture log size and reduce time to sort / search / further filter results.

I can't comment on the performance hit really, we didn't notice any significant problems with the machine following the capture, but then it was *only* running packet sniffing (and getting itself infected by Nachi).
0
 
LVL 3

Author Comment

by:jasef
ID: 12296769
Thanks Chris, your input is much appreciated. The filtering is the purpose of my IP Ports question submitted not long after this one :)

Has anyone tried this on a server performing login authentication and/or file sharing?
I suspect if capturing is only say 10% of the traffic, it won't have a huge impact but it'd be nice to hear from someone who's tried it.
0
 
LVL 3

Assisted Solution

by:_Jochen_
_Jochen_ earned 100 total points
ID: 12296835
hi,
i think 10% is a good value. I´ve always used etheral on our Servers and we never have had problem which caused on etheral. Normally it´s no problem to do this.
jo
0
 
LVL 15

Assisted Solution

by:Frabble
Frabble earned 250 total points
ID: 12303902
It should be OK, but after reading your other posts I would suggest you capture on another machine. On the Cisco switches you can set up a monitoring session, miroring both transmit and receive traffic of mulitple ports to another, which has the data capture machine.

Set up Ethereal to limit the captured packet size, enter a file name and use multiple files. You can then have new files created based on size or time. For example limit to 30 minutes and enable a ring buffer based on the amount of disk space you have. Setting it to 12 would give you captures for the last 6 hours. If the files are too big then configure based on file size.
You can leave this running until the problem occurs, stop and then look at the relevant capture file. Ethereal will then let you filter, display specific conversations, graph network usage etc. to help you isolate the problem.
0
 
LVL 3

Author Comment

by:jasef
ID: 12306386
Thanks everyone.  I really appreciate your assistance with these queries.  Special thanks to Frabble... an excellent suggestion I hadn't though of!
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
vSphere 5.5 - move subnet to another data center? 2 20
Windows 7 Internet issue 14 54
Blacked by spamhaus? 26 72
VTP servers with 3650 switches 5 27
#Citrix #Citrix Netscaler #HTTP Compression #Load Balance
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question