topic Re: Monitor Port sniffing in Switches, Hubs, and Modems

Monitor Port sniffing

Wayne Fussell — Thu, 04 Sep 2003 01:43:09 GMT

Greetings All,

I'm trying to see all the traffic going across a specific port. I've set the monitor port ON & selected a port to monitor. Plugged a laptop into the monitor port and I can see broadcast/multicast traffic from everywhere but can only see unicast traffic coming from the device on the monitored port not traffic going to that port ie only one side of the conversation. The switches in question are 4108GL's & 2524's with only the default VLAN.

Trying the same thing on a Dell switch shows both sides of a conversation.

I'm wondering if I've turned something on or off on the HP switches that is stopping me seeing all the traffic traversing that port.

Thanks in advance

Re: Monitor Port sniffing

Arimo Laine_2 — Thu, 04 Sep 2003 14:13:24 GMT

Hi

"if I've turned something on or off on the HP switches"

You haven't. The switches indeed only show ingress traffic when you monitor. If you need to capture traffic on both directions, you need to plug a hub to the port which you want to monitor and connect the sniffer there.

Arimo

Re: Monitor Port sniffing

Wayne Fussell — Thu, 04 Sep 2003 22:14:07 GMT

Thanks Arimo,

I'd previously done some looking around google on this issue and you've confirmed what I'd found.

What confused me was the port monitor on a Dell switch can see the conversation going both ways.

wayne

Re: Monitor Port sniffing

Ardon — Thu, 20 Nov 2003 04:50:46 GMT

Hi,

Just one small note. The 2524 DOES monitor Ingress and Egress both at the same time. It's the 41XX having the limitatation of Ingress only.

Thanks, Ardon