First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Can Saving to a Network SAN drive cause a false positive of missing packets?

  • retag add tags

Will putting the save location of a Packet capture from wireshark to a Network SAN drive cause a false positive of missing packets as wireshark will not be able to write to the location fast enough because of network latency? (Not network itself dropping packets, but just a slow network)

I looked through documentation, but I did not see any recommendations to ensure that the save location for the packet capture is local to the server that is capturing the file.

History:

While recently working on an issue, I was attempting to troubleshoot an issue where my product's VOIP recorder was not recording any audio for certain calls.

I showed the customer how to set up a wireshark packet capture, and instructed them to run a packet capture periodically throughout the week to capture certain calls that they knew would not record.

However, when I looked at the packet capture, there was only 2 packets out of 80,000 RTP packets that we should have received, and we did not receive any SIP packets... even though our recorder said that we did. (logs showed that it received the SIP traffic)

We started to troubleshoot the wireshark itself to find out why it wasn't capturing the traffic as expected.

We found that the customer had been saving the file to a Network SAN drive that the customer had mapped to the server. Thinking that this might be the cause, we asked the customer to instead save the packet capture on a Local drive. (as in a HDD or SSD on the server itself)

After the customer ran a packet capture that was saved onto a local drive, we saw that the packet capture had received ALL of the packets without issue, and that we did in fact see the RTP and the SIP traffic.

It turns out it was an issue with the recorder itself, and not with their network...

Viridianscarab's avatar
1
Viridianscarab
asked 2017-12-20 16:00:09 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

Be aware that the network traffic caused by the Network SAN also goes through a network interface. If that interface happens to be the one you're capturing on then this will add to the data to the Network SAN, which..., ad infinitum.

So if you do this make sure to have the proper capture filters in place that you don't capture anything related to the Network SAN interaction.

Jaap's avatar
13.7k
Jaap
answered 2017-12-20 16:41:40 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer