[prev in list] [next in list] [prev in thread] [next in thread]
List: wireshark-users
Subject: Re: [Wireshark-users] I think this is outrageous, but am i wrong?
From: Matt Moeller <moellermatthew () yahoo ! com>
Date: 2010-02-18 17:41:51
Message-ID: 531345.15701.qm () web63502 ! mail ! re1 ! yahoo ! com
[Download RAW message or body]
[Attachment #2 (multipart/alternative)]
I believe the original statement was that HDX will prevent equipment buffer overrun \
and subsequent discards. I stick by that.
________________________________
From: Ryan Zuidema <ryan.zuidema@knchlaw.com>
To: Community support list for Wireshark <wireshark-users@wireshark.org>
Sent: Wed, February 17, 2010 5:44:46 PM
Subject: Re: [Wireshark-users] I think this is outrageous, but am i wrong?
I do not agree that half duplex will prevent T-1 overrun. Half
duplex can only introduce additional delay/loss over the link. With the collisions
associated with half duplex you will have a lot more garbage going across your
T-1 (retransmits etc…). Also you'll have delays as the computers
back off during the retransmission process. Half duplex has no positive
effect in your situation, and could be contributing to the issues your
having.
I strongly recommend switching it over to Full duplex.
It's probably a negotiation issue. During your next outage window force
it to Full duplex and test it out.
That said, you probably have other issues in play here; it is
quite easy to overuse a T-1.
-Ryan
From:wireshark-users-bounces@wireshark.org
[mailto:wireshark-users-bounces@wireshark.org] On Behalf Of jack craig
Sent: Wednesday, February 17, 2010 2:37 PM
To: wireshark-users@wireshark.org
Subject: Re: [Wireshark-users] I think this is outrageous, but am i
wrong?
its a cisco pix 506, not new,
but capable of full/half duplex.
one response i got was that the half duplex would keep the t1 from being
overrun as much.
you dont agree?
personally, i find it hard to imagine a case where half duplex is better than
full,
but i have learned other new information today.
Thx very much for your response, jackc....
On 02/17/2010 12:42 PM, Ryan Zuidema wrote:
The bottleneck to the cloud is your T-1. No firewall being set
to 10Mbs/100Mbs/1Gbps will make any difference there. In your situation 10Mbps
is more than enough. I wouldn't be shocked to see 10Mbps dealing with WAN
type equipment, precisely because it's more than enough to fill the
average pipe. *10Mb = Not outrageous at all*
Half duplex could be an issue with high packet rates. This is
possible even at low bandwidth utilization. If you're running VoIP,
terminal emulation or any other type of high packet rate streaming you could
see a lot of collisions. Half-duplex is more unusual and something I would
change. *HDx = Not outrageous, but worth fixing/changing*
Is the firewall capable of full duplex? Perhaps it just failed
to properly auto-negotiate? What type of firewall is it (make/model)?
-Ryan
From:wireshark-users-bounces@wireshark.org \
[mailto:wireshark-users-bounces@wireshark.org] On Behalf Of jack \
craig
Sent: Wednesday, February 17, 2010 10:22 AM
To: Community support list for Wireshark
Subject: [Wireshark-users] I think this is outrageous, but am i wrong?
Hi
Wireshark Folks,
The below query is not Wireshark specific, just a basic networking topic.
Pls hit delete if you dont care to read more.
I pose this query to this forum just because the collection of talent here
should vindicate or refute my own sanity.
pls consider this network topology?
a site has a T1 to the cloud. following that T1 into the domain, we first
encounter the T1 router,
then on to a firewall, and arriving finally at a 10/100 Mbps switch where its
distributed to internal users.
our access to the cloud has been degraded so we look for reasons why?
we find that the firewall is configured on both input/output sides to be 10
Mbps, half duplex.
AFAIK, upgrading the firewall interfaces to 100 Mpbs/FDx would increase the
throughput by 10 times (ideally)
and enable bidirectional traffic (as opposed to limiting to a single direction at
once).
am i missing something obvious here? is there any reason a 10 Mbps/HDx link is
better than 100Mbps/FDx ??
tia, jackc...
--
Jack Craig
Software Engineer
831.461.7100 x120
www.extraview.com
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@wireshark.org?subject=unsubscribe
--
Jack Craig
Software Engineer
831.461.7100 x120
www.extraview.com
[Attachment #5 (text/html)]
<html><head><style type="text/css"><!-- DIV {margin:0px;} \
--></style></head><body><div \
style="font-family:arial,helvetica,sans-serif;font-size:12pt"><div>I believe the \
original statement was that HDX will prevent equipment buffer overrun and subsequent \
discards. I stick by that.<br></div><div style="font-family: \
arial,helvetica,sans-serif; font-size: 12pt;"><br><div style="font-family: times new \
roman,new york,times,serif; font-size: 12pt;"><font face="Tahoma" size="2"><hr \
size="1"><b><span style="font-weight: bold;">From:</span></b> Ryan Zuidema \
<ryan.zuidema@knchlaw.com><br><b><span style="font-weight: \
bold;">To:</span></b> Community support list for Wireshark \
<wireshark-users@wireshark.org><br><b><span style="font-weight: \
bold;">Sent:</span></b> Wed, February 17, 2010 5:44:46 PM<br><b><span \
style="font-weight: bold;">Subject:</span></b> Re: [Wireshark-users] I think this is \
outrageous, but am i wrong?<br></font><br>
<style>
<!--
_filtered {font-family:"Cambria Math";panose-1:2 4 5 3 5 4 6 3 2 4;}
_filtered {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}
_filtered {font-family:Tahoma;panose-1:2 11 6 4 3 5 4 4 2 4;}
_filtered {font-family:Consolas;panose-1:2 11 6 9 2 2 4 3 2 4;}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;margin-bottom:.0001pt;font-size:12.0pt;font-family:"Times New Roman", \
"serif";color:black;} a:link, span.MsoHyperlink
{color:blue;text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;text-decoration:underline;}
pre
{margin:0in;margin-bottom:.0001pt;font-size:10.0pt;font-family:"Courier \
New";color:black;} span.HTMLPreformattedChar
{font-family:Consolas;color:black;}
span.EmailStyle19
{font-family:"Calibri", "sans-serif";color:#1F497D;}
span.EmailStyle20
{font-family:"Calibri", "sans-serif";color:#1F497D;}
.MsoChpDefault
{font-size:10.0pt;}
_filtered {margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{}
-->
</style>
<div class="Section1">
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);">I do not agree \
that half duplex will prevent T-1 overrun. Half duplex can only introduce additional \
delay/loss over the link. With the collisions associated with half duplex you will \
have a lot more garbage going across your T-1 (retransmits etc…). Also you'll have \
delays as the computers back off during the retransmission process. <b>Half duplex \
has no positive effect in your situation</b>, and could be contributing to the issues \
your having.</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);"> \
</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);">I strongly \
recommend switching it over to Full duplex. It's probably a negotiation issue. During \
your next outage window force it to Full duplex and test it out.</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);"> \
</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);">That said, you \
probably have other issues in play here; it is quite easy to overuse a T-1. \
</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);"> \
</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, \
125);">-Ryan</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);"> \
</span></p>
<div>
<div style="border-style: solid none none; border-color: rgb(181, 196, 223) \
-moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: \
3pt 0in 0in;">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: \
"Tahoma","sans-serif"; color: windowtext;">From:</span></b><span \
style="font-size: 10pt; font-family: "Tahoma","sans-serif"; \
color: windowtext;"> wireshark-users-bounces@wireshark.org \
[mailto:wireshark-users-bounces@wireshark.org] <b>On Behalf Of </b>jack craig<br> \
<b>Sent:</b> Wednesday, February 17, 2010 2:37 PM<br> <b>To:</b> \
wireshark-users@wireshark.org<br> <b>Subject:</b> Re: [Wireshark-users] I think this \
is outrageous, but am i wrong?</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><span style="font-size: 13.5pt;">its a cisco pix 506, not new,
but capable of full/half duplex.<br>
<br>
one response i got was that the half duplex would keep the t1 from being
overrun as much.<br>
you dont agree? <br>
<br>
personally, i find it hard to imagine a case where half duplex is better than
full,<br>
but i have learned other new information today.<br>
<br>
Thx very much for your response, jackc....<br>
</span><br>
On 02/17/2010 12:42 PM, Ryan Zuidema wrote: </p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);">The bottleneck \
to the cloud is your T-1. No firewall being set to 10Mbs/100Mbs/1Gbps will make any \
difference there. In your situation 10Mbps is more than enough. I wouldn't be shocked \
to see 10Mbps dealing with WAN type equipment, precisely because it's more than \
enough to fill the average pipe. <b>*10Mb = Not outrageous at \
all*</b></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, \
125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);">Half duplex \
could be an issue with high packet rates. This is possible even at low bandwidth \
utilization. If you're running VoIP, terminal emulation or any other type of high \
packet rate streaming you could see a lot of collisions. Half-duplex is more unusual \
and something I would change. <b>*HDx = Not outrageous, but worth \
fixing/changing*</b></span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, \
125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, 125);">Is the firewall \
capable of full duplex? Perhaps it just failed to properly auto-negotiate? What type \
of firewall is it (make/model)?</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, \
125);"> </span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, \
125);">-Ryan</span></p>
<p class="MsoNormal"><span style="font-size: 11pt; font-family: \
"Calibri","sans-serif"; color: rgb(31, 73, \
125);"> </span></p>
<div>
<div style="border-style: solid none none; border-color: windowtext \
-moz-use-text-color -moz-use-text-color; border-width: 1pt medium medium; padding: \
3pt 0in 0in;">
<p class="MsoNormal"><b><span style="font-size: 10pt; font-family: \
"Tahoma","sans-serif"; color: windowtext;">From:</span></b><span \
style="font-size: 10pt; font-family: "Tahoma","sans-serif"; \
color: windowtext;"> <a rel="nofollow" \
ymailto="mailto:wireshark-users-bounces@wireshark.org" target="_blank" \
href="mailto:wireshark-users-bounces@wireshark.org">wireshark-users-bounces@wireshark.org</a>
[<a rel="nofollow" ymailto="mailto:wireshark-users-bounces@wireshark.org" \
target="_blank" href="mailto:wireshark-users-bounces@wireshark.org">mailto:wireshark-users-bounces@wireshark.org</a>]
<b>On Behalf Of </b>jack craig<br>
<b>Sent:</b> Wednesday, February 17, 2010 10:22 AM<br>
<b>To:</b> Community support list for Wireshark<br>
<b>Subject:</b> [Wireshark-users] I think this is outrageous, but am i \
wrong?</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal" style="margin-bottom: 12pt;"><span style="font-size: 13.5pt;">Hi
Wireshark Folks,<br>
<br>
The below query is not Wireshark specific, just a basic networking topic.<br>
Pls hit delete if you dont care to read more.<br>
<br>
I pose this query to this forum just because the collection of talent here
should vindicate or refute my own sanity.<br>
<br>
pls consider this network topology? <br>
<br>
a site has a T1 to the cloud. following that T1 into the domain, we first
encounter the T1 router,<br>
then on to a firewall, and arriving finally at a 10/100 Mbps switch where its
distributed to internal users.<br>
<br>
our access to the cloud has been degraded so we look for reasons why?<br>
<br>
we find that the firewall is configured on both input/output sides to be 10
Mbps, half duplex.<br>
<br>
AFAIK, upgrading the firewall interfaces to 100 Mpbs/FDx would increase the
throughput by 10 times (ideally) <br>
and enable bidirectional traffic (as opposed to limiting to a single direction at
once).<br>
<br>
am i missing something obvious here? is there any reason a 10 Mbps/HDx link is
better than 100Mbps/FDx ??<br>
<br>
tia, jackc...<br>
<br>
</span></p>
<pre>-- </pre><pre>Jack Craig</pre><pre>Software Engineer</pre><pre>831.461.7100 \
x120</pre><pre><a rel="nofollow" target="_blank" \
href="http://www.extraview.com">www.extraview.com</a> </pre><pre> </pre><pre> \
</pre><pre>___________________________________________________________________________</pre><pre>Sent \
via: Wireshark-users mailing list <a rel="nofollow" \
ymailto="mailto:wireshark-users@wireshark.org" target="_blank" \
href="mailto:wireshark-users@wireshark.org"><wireshark-users@wireshark.org></a></pre><pre><span>Archives: \
<a target="_blank" href="http://www.wireshark.org/lists/wireshark-users">http://www.wireshark.org/lists/wireshark-users</a></span></pre><pre>Unsubscribe: \
<a rel="nofollow" target="_blank" \
href="https://wireshark.org/mailman/options/wireshark-users">https://wireshark.org/mai \
lman/options/wireshark-users</a></pre><pre> \
<a rel="nofollow" ymailto="mailto:wireshark-users-request@wireshark.org?subject=unsubscribe" \
target="_blank" href="mailto:wireshark-users-request@wireshark.org?subject=unsubscribe">mailto:wireshark-users-request@wireshark.org?subject=unsubscribe</a></pre> \
<p class="MsoNormal" style="margin-bottom: 12pt;"> </p>
<pre>-- </pre><pre>Jack Craig</pre><pre>Software Engineer</pre><pre>831.461.7100 \
x120</pre><pre><a rel="nofollow" target="_blank" \
href="http://www.extraview.com">www.extraview.com</a> </pre></div>
</div></div>
</div><br>
</body></html>
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@wireshark.org?subject=unsubscribe
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic