topic Port Mirroring Doesn't Work in Switches, Hubs, and Modems

Port Mirroring Doesn't Work

KSimpson — Thu, 27 May 2010 14:25:24 GMT

Hello all,

I'm trying to capture some traffic on a mirrored port but it's not returning the results that I'm expecting. Basically all I have done at this point is set up the port mirroring and tried to test it by pinging a device on the monitored port.

This is how I have it setup.

-config-
mirror-port 6 - laptop with capturing software
interface 3 - printer
monitor
exit

--

-show monitor results-
Network Monitoring Port
Mirror Port: 6
Monitoring sources
------------------
3
--

When I ping the printer (on monitered port 3) from a workstation (random port on same switch), my capturing software (on mirrored port 6)does not capture the icmp taffic. All I'm getting is all broadcast traffic. I have tried this on (2) 2810's and a 2626PWR switch. I've getting the same results on all the switches.

Am I doing something wrong or am I missing something?? Can someone shed some light. :)

Thanks alot!

Re: Port Mirroring Doesn't Work

Richard Brodie_1 — Thu, 27 May 2010 14:44:55 GMT

Double check that your capturing software is enabling promiscuous mode on your network adaptor.

Re: Port Mirroring Doesn't Work

KSimpson — Thu, 27 May 2010 15:15:12 GMT

Thanks for your reply. I'm using the Omnipeek software. I'm not able to find anything about proiscuous mode in the software. This is what I have found from their documentation.

"OmniPeek will run with any NDIS 3 or higher compatible Ethernet promiscuous mode network adapter. Almost all Ethernet adapters on the market today meet this requirement. For example, we are compatible with adapters from 3Com, Intel, Xircom, SMC, and many others."

But I can't locate the actually setting within the software.

On another note, I did try capturing the traffic using Wireshark. The promiscuous mode is enabled on the adapter but it didn't the capture the ICMP traffic either.

a side note.
Earlier I pinged the printer from the laptop that is capturing the traffic and I was able to capture the icmp traffic but of course the traffic was coming from the same interface/device.

Re: Port Mirroring Doesn't Work

Shadow13 — Fri, 28 May 2010 18:22:56 GMT

Can you post your configuration plz