Java – Is Winpcap able to capture all packets going through a Gigabit NIC without missing any packets

javanetworkingtcpipwinpcapwireshark

I want to use Winpcap to capture all network packets going through a Gigabit NIC of a server.

Assuming that I am able to utilize the network link up to 100%, the maximum network speed is 1000Mbps. If we exclude the TCP/IP headers, the maximum TCP data rate should be roughly 940Mbps.

Let's say I send a 1GB file through the NIC at 940Mbps using TCP destination port 6000. I use Winpcap to capture all network packets going through the NIC and then dump it to a pcap file. If I use Wireshark to analyze the pcap file and then check the sum of packet size for all network packets sent to TCP port 6000, am I able to get exactly 1GB from the pcap file?

Thanks.

Best Answer

Assuming that you are able to utilize the network link up to 100%, the maximum network speed is NOT 1Gbps. It's less due to inter frame gaps and checksums. This is even before you start taking into account packet headers (as you correctly mentioned in your original question).

Also as implied by a comment above, a typical machine will struggle to generate packets at wirespeed, let alone generate AND capture packets at the same time at wirespeed. The one method I use to generate packets at wirespeed (on a linux machine) is crafting 1500 bytes packets and using tcpreplay. Using this method, I can get very close to wirespeed, but this utilizes the CPU ~100%, unless you are on a very very fast machine.

Having said all that, there's nothing wrong with your plan to determine the amount of data sent to TCP port 6000 by capturing and viewing with wireshark. (Make sure you ONLY capture TCP port 6000, rather than all packets on the interface.) You just need to ensure that the CPU is not loaded 100% such that the packet capture isn't able to process all packets. But then, this is true regardless of which method you use.

Related Solutions

Tcpdump filter for tcp zero window messages

I think it can be done using a filter like:

"tcp[14] = 0 && tcp[15] = 0"

The tcp[i] notation means the index i of TCP header. The window size is located after 14 bytes from TCP header. For more info, you can look at man pcap-filter.

Java – How to use tshark to do this task

What I want to do is that first I let tshark to read from that pcap file, and then use the time range to filter out all the network flows that are in that time range

You should do it with editcap:

$ editcap -A "2011-07-12 09:49:16" -B "2011-07-12 09:49:20" in.pcap out.pcap

and then use the ip addr to filter out all the network flows from that ip addr, and then use the tcp port number and the number of packets sent/received by the ip addr to finally locate the flow I want.

$ tshark -r out.pcap -R "ip.addr == $IP && tcp.port == $PORT"

Then follow this flow/stream

$ tshark -r out.pcap -R "ip.addr == $IP && tcp.port == $PORT" \
    -T fields -e ip.src -e tcp.srcport -e ip.dst -e tcp.dstport | \
    while read line; do tshark -r out.pcap \
        -R "ip.addr == `echo $line | awk '{ print $1 }'` && \
        tcp.port == `echo $line | awk '{ print $2 }'` && \
        ip.addr == `echo $line | awk '{ print $3 }'` && \
        tcp.port == `echo $line | awk '{ print $4 }'`" \     
        echo \
    done

Best Answer

Related Solutions

Tcpdump filter for tcp zero window messages

Java – How to use tshark to do this task

Related Topic