Can WireShark detect Ethernet PAUSE packets on network when running on Windows?
We have a Windows server which is connected to a switch processing a large quantity of data. We noticed that when we disabled FlowControl on the network adapter, that it appeared that we were getting much better performance. We are occasionally getting dropped packets, which we are ok with, but the rest of the time we appear to get much better throughput.
We would like to verify that when FlowControl is enabled, that the server is indeed sending PAUSE messages. I was under the impression that WireShark would not be able to see these packets because they don't get passed to the OS, but on Wikipedia's entry for FlowControl http://en.wikipedia.org/wiki/Ethernet_flow_control, there is an image of a "WireShark" screenshot of an ethernet "Pause" frame.
In what scenarios does WireShark have the ability to see PAUSE frames?
Solution 1:
a pause frame is handled by the switch, not the conversation partner. so the only ways to capture a pause frame are:
- be physically listening in on the link between the computer and the switch
- run wireshark on the computer sending the pause frame (if the NIC driver supports it)
- use a switch that forwards the pause frame to the monitoring port
other ways to verify PAUSE is causing the problem:
- watch the pause counters on the switch while turning flow control on and off and monitoring the bandwidth
- can't think of any other off the top of my head. :)