Capture problems with Intel quad cards?

Mon Feb 16 05:35:30 UTC 2009

Has anyone had problems with using current Intel quad ethernet cards for 
packet capture?  As a proof-of-concept test we bought an Intel PWLA8494GT 
and hooked it up to some Network Critical taps.  There was a very strange 
issue with corruption of the captured packets.  The *only* issue (but it's 
a big one) is that the source IP on some captured packets is munged.  As 
far as I can tell that's the *only* issue with the packet captures - no 
other data is corrupted.

Oh, and to rule out other issues:

1.  Corruption seen both when using network taps and when using a port
span/mirror (so it's not the taps).
2.  Corruption *not* seen using the on-board broadcom nics of the test
host (so it's not the box).

So I'm pretty sure we narrowed it down to the card.  We tried the card in
an indentical host and saw the same problems.

I thought it might be a driver issue - I tried both gentoo and FreeBSD 
(not sure how different the drivers are) just to see if it mattered at all 
and it didn't.  Much googling didn't show this to be a known issue - just 
wondering if anyone else has seen it?  Other recommendations welcome - the 
next step is, I suppose, a broadcom-based PCI-X card.  (I've got some old 
pizza boxes I'm trying to repurpose as network probes.)

Thanks,
John

-- 
                                John A. Kilpatrick
john at hypergeek.net                Email|     http://www.hypergeek.net/
john-page at hypergeek.net      Text pages|          ICQ: 19147504
                  remember:  no obstacles/only challenges