Recent content by mpennac

Makes using a hardware based analyzer not look like such a bad thing. Did you guys monitor the CPU utilization during the test? I am curious as to what was the limiting factor. Mike

Tony, you rock! Mike

Various operating systems use different starting time to live values. For example, early version of MS Windows used a TTL of 32. This was great when networks were small, but as the Internet grew so did the starting TTL. Most Windows systems start with a TTL of 128 these days. I have noticed...

Yes, you need to run Iperf on both ends of the connection. On one end type: iperf -s This end will receive the data. On the other end type: iperf -c <ip address of receiver> This end will transmit the data. You must give the transmitter the IP address of the receiver. Mike

Sadly Spanning Tree is blamed for many problems that it does not cause. Unless you have a switch or link that is constantly going up and down, spanning tree will have no affect on your network. I have worked on many problems where everyone was pointing their fingers at spanning tree, only to...

Portfast most affects a device's abilitiy to get a DHCP address. Spanning tree by default will wait 30 seconds from the time that the link is enabled on a port to when it will begin forwarding packets. This gives the port time to ensure that there are no loops present. Unfortunately, most...

The key to capturing all of the packets seen by your NIC is to put the analyzer in promiscuous mode. This is a checkbox in the capture setup. The other thing to keep in mind is that on a switched network you will only see packets to and from the analyzer as well as broadcasts and multicasts...

I use Iperf, it rocks. It is free, it is easy to use, and it supports multiple platforms. Here is a link to it: http://dast.nlanr.net/Projects/Iperf/ From the commandline type iperf -s on the receiving end. Then iperf -c <ip address of receiver> on the other end. It will transfer data for...

Depends on the operating system. By default Microsoft will retransmit a TCP segment 5 times before it kills the connection. Each time it doubles the retransmission timer. Here is the registry key information to change that if desired: TcpMaxDataRetransmissions Key: Tcpip\Parameters Value...

This has to do with Sniffer using the NDIS drivers to communicate with the Network Interface Card. NDIS will not pass frames containing bad CRCs up the protocol stack. As a result, the Sniffer cannot capture, count, or display them. To get around this, they wrote a network interface card...

Should be able to do this through the ROUTE command, depending on the OS. On the server, put a route statement in telling the server to send all traffic to the default router using the IP of Connection A. On the router, put a route statment in telling the router to send all traffic to the IP...

The last 4 bytes of the minimum frame is the CRC/FCS field. So, if the station is transmitting the CRC/FCS field (Bytes 61 - 64) and receives a collision, it should retransmit the frame at a Data Link layer, with only a minimal delay. This would be a fragment, a collision after we have started...

Peter, all TCP implementations are designed to handle up to 64K bytes of data from the upper layers, typically the application layer. They will all break this data up into datagrams not greater than the Maximum Segment Size and hand that data along with the TCP header down to the Network Layer...

Jason, TCP does break up most of the data on the sending host. For example. If a server wanted to send 64K of data to a client, it would hand that 64K down to TCP. TCP would look at the MTU for the network connection to determine the Maximum Segment Size (MSS). The MSS is the maximum amount...

For Ethernet there are three types of collisions that will occur. 1) Preamble collision. Device A begins transmitting the preamble (alternating pattern of 1's and 0's, 64 bits in length) prior to sending the first bit of the destination address. Device B has not yet received A's preamble, and...