[OLUG] collisions - tcpdump, ethereal, etc

[brian at cbiowa.com]

	Thanks for all the info.  I was looking for the quick fix for what
seemed like an easy problem.  When you have 3 computers connected
together and the only thing all of them are doing is ftping a file from
one machine to another, other than the normal NetBUI traffic, there
shouldn't be any trouble.  I am going to give tcpdump a try while I am
doing the ftp and hopefully figure out from that what packets are
colliding.  I believe that is what you were suggesting below.  It sounds
like the best road to go down.  Thanks again to all who helped.

puzzled wrote:
> 
>    Collisions are a normal part of ethernet operation. When connected to
> a hub a workstation listens for a short period of time to be sure its
> got a free wire, starts to transmit, and then if it bumps into another
> machines transmission both of the machines back off for a random period
> of time.
> 
>     Divide the number of collisions by the number of frames sent, the
> rule of thumb is it should be less than 15% on a hub and just about zero
> on a switch port. Your mileage may vary considerably on the hub rule but
> the switch should almost never give a report of a collision ...
> theoretically it never happens with full duplex but in practice I've
> seen continuous very low rates of that behavior on 3com switches and
> various Cisco products.
> 
>    Describe the topology you're using - if your workstation is on a
> switch port and the target server is on a hub your frames could be dying
> by remote collision and you have no visibility into that unless you're
> examining network stats on the other end of the connection. Switch
> forwarding mode also makes a difference ... do you have access to the
> switch if there is such a device involved?
> 
>    Fire up tcpdump and set it to watching the afflicated interface. Dump
> all of the output to a file and write a simple perl script that will
> parse the output and look for retransmission of tcp sequence numbers in
> packets. If this greek to you there is an excellent english/greek
> translation called "TCP/IP Illustrated Volume 1" by W Richard Stevens.
> 
>    Calculate the overhead associated with the connection. 10 mbit/8
> bits/byte = 1.25 mbytes/sec *but* you have to consider the ack packet
> for every packet you receive, the effects of packet size vs MTU for the
> media, buffer issues on the systems involved, etc, etc.
> 
>   If tcpdump scares you take a look at ethereal instead - easy to
> install, easy to get started using. You can find it on
> www.freshmeat.net.
> 
>   I can't recommend the TCP/IP Illustrated book highly enough but you
> only need volume 1 unless you're going to code network utilities.
> 
> -------------------------------------------------------------------------
> Sent by OLUG Mailing list Manager, run by ezmlm.  http://olug.bstc.net/
> To unsubscribe: `echo unsubsribe | mail olug-unsubscribe at bstc.net`

-- 
             Brian Weber
         Computer Consultant
             Cap Gemini
      brian at mail.cbiowa.com

-------------------------------------------------------------------------
Sent by OLUG Mailing list Manager, run by ezmlm.  http://olug.bstc.net/ 
To unsubscribe: `echo unsubsribe | mail olug-unsubscribe at bstc.net`