A bit of a strange one here.

I've used wireshark loads of times and it's always been flawless.

However, I'm trying to analyse some network issues on a customer's site and I'm baffled because it only seems to pick up a small percentage of traffic that's going through.

Now I'm actually monitoring a teamed connection of two on-board HP NICs (Broadcom) in a set of DL360 G5 servers. The team is an 802.3ad dynamic team, and the Cisco switch at the other end has been setup properly with a port channel and a channel group set to LACP.

The network appears to be functioning fine, and if I copy across a large file, I see the packets in the network properties shoot up, the file comes across at a rate of knots, but no packets are logged in wireshark, despite me selecting the correct interface and reporting the correct IP address. If I install wireshark at the client side, it logs all traffic.

I've used wireshark in similar scenarios before, but admittedly, they were with just a network fault tolerance, yet had no issues, so not sure if it's because of the 802.3ad team or something else. :confused:

Totally lost here, especially as *some* traffic is logged as expected. I initially had an older 0.99 or something version, but have now upgraded to latest 1.0.3 with no result.

Did a quick web search but no ideas. Anyone out there have any :confused: :confused:

Have you tried running ethereal on the interface in promiscuous mode?

You could put that on one of the PC's to at least see if the packets are being sent.

Also can you set your cisco up to replicate the input to a spare port so you could dump that out.

I've never really done this stuff over wireless as we only dealt with high bandwidth work.

Yeah, I ended up setting up a SPAN monitor session on the cisco to replicate all traffic on the port-channel interface over to a physical gigabit interface, and it appears to be showing everything now.

Out of interest, where did you get the wireless bit from? And yes, this is high bandwidth, in fact, it's tracking stuff going to and from you know what :P

Your final solution is what I was going to suggest. maybe Wireshark doesn't do teamed virtual interfaces? I've not tried it.

Yeah, I ended up setting up a SPAN monitor session on the cisco to replicate all traffic on the port-channel interface over to a physical gigabit interface, and it appears to be showing everything now.

Out of interest, where did you get the wireless bit from? And yes, this is high bandwidth, in fact, it's tracking stuff going to and from you know what :P

I misread the 802.3 as 802.11 the wireless spec... stupid me.

As for that what it's going to, that's interesting are you guys having problems on the network side or the `high bandwidth` network side?

It's on the traditional network side.

I think it's a Windows share / AD / DNS / AD account problem.

Everything is working fine, then all of a sudden, all clients lose connection to the NAS head through which they access content. But it's not a pure network problem because you can still ping the NAS server and remote desktop still works, etc.

But it only happens from time to time, and debugging it is proving to be a nightmare, and we haven't found a way of forcing the error. Of course, considering the amount of data read through the NAS, I can't leave wireshark running on it indefinately as it's around 5000 packets per second! Talk about a needle in a haystack and I don't even know what the needle looks like :eek:

The next option is to have wireshark installed on the clients, but we need to have it installed before the connection is lost, and again, we don't know when it happens.

A bit tricky really

Fibre channel analyser with a trigger on the any fault packets?

Fibre channel analyser with a trigger on the any fault packets?

Problem is on the network side, not the FC side, and the network side is Cat5e copper, not SMF or MMF. :P

All resolved now using a mon session on the cisco

I'm going to go stick my head in the sand I think.

I've managed to completely ignore the obvious info in front of me on two occasions now.

I'm going to go stick my head in the sand I think.

I've managed to completely ignore the obvious info in front of me on two occasions now.

No problem. I'm hoping to go and see Bas some time soon. I'll bring some sand back for you