2 Packet Capture Methods

Packet capturing is an important part of a network administrator’s tool-chain. It is often used to “dig down” into the specific traffic traversing a network. Because of this, it is important that a packet capturing method provides a correct view of how the network acts. Thus, a packet capturing platform must be able to keep up with the line-rate of the router it is co-located with; for most enterprise level networks this is 1 gigabit per second. The purpose of this measurement study is to determine what software packet capture method works best and what hardware platform is able to support the speeds. This is done through two two-factor full factorial experimental designs which test three packet capturing methods under two kernel configurations and three packet capturing methods on three machine types. The results indicate that the kernel configuration does not have as great an effect as previously thought when compared to the packet capture method; they also sho