Packet Capture - Timings and 802.1p
-
I changed my floating rules to set 802.1p bits and I'm not seeing them in the captures. I read in some places about wireshark that the QoS data is stored in the same area as VLAN data which may cause the OS/driver to strip this info out.
Next question. Timings. Are the time stamps on egress the actual times they left or when they were enqueued? I'm asking because I'm seeing 600Mb/s bursts of around 8 packets at a time with overall averages of around 20Mb/s. I don't see regularly spaced packets, I see regularly spaced bursts of packets.
I'm also seeing strange timings on the ingress. 9 1514 byte packets in 0.000064 seconds, regularly spaced batches. That actually works out to 1.7Gb/s, which is just a weeeee bit faster than my 1Gb network. I assume it has something to do with the NIC coalescing interrupts. Still, the data must be coming in at near 1Gb/s rates, even if for these really small bursts.