Comware Based
cancel
Showing results for 
Search instead for 
Did you mean: 

Port Mirroring on 5500 Switch

 
jsuoh
Occasional Visitor

Port Mirroring on 5500 Switch

Seen a couple of posts about this before but with no solution, so wondering if anyone is having similar problems.

 

I have configured port mirroring on a HP A5500 switch port (g1/0/12) to mirror both directions, and then a seperate port as the monitor port (g1/0/47). The problem is I only appear to see traffic going in one direction (inbound on g1/0/12), and i cant see anything going outbound (Eg. When analysing DHCP Handshake, i only see DHCPDISCOVER and DHCPREQUEST, even though the machine on the end of g1/0/12 has obtained an IP address sucessfully).

 

Below is the mirroring group config.

 

mirroring-group 1:
type: local
status: active
mirroring port:
GigabitEthernet1/0/12 both
monitor port: GigabitEthernet1/0/47

 

Switch software version:

 

HP Comware Platform Software
Comware Software, Version 5.20.99, Release 2221P08

 

 

 

 

6 REPLIES
Vince-Whirlwind
Honored Contributor

Re: Port Mirroring on 5500 Switch

Do you have your Wireshark set to "promiscuous"?

jsuoh
Occasional Visitor

Re: Port Mirroring on 5500 Switch

Yes, its set to promiscuous.

Vince-Whirlwind
Honored Contributor

Re: Port Mirroring on 5500 Switch

Some security applications replace your TCP/IP stack when you install them and prevent promiscuous from working.

I had this with McAfee, from memory.

jsuoh
Occasional Visitor

Re: Port Mirroring on 5500 Switch

Its strange, I can mirror off other devices without any problems, and i have tried multiple devices on the 5500.

Vince-Whirlwind
Honored Contributor

Re: Port Mirroring on 5500 Switch

In that case it must be the switch.

I would remove the mirror-port config, reboot the switch (if possible - maybe schedule a "vital firmware upgrade, for security reasons") then re-add it, maybe using a different mirror-group.

drolfe
Valued Contributor

Re: Port Mirroring on 5500 Switch

It's not the switch, as I have the exact same issue, I can see inbound from the internet but not outbound

mirroring-group 1 remote-source
vlan 50
mirroring-group 1 remote-probe vlan 50
mirroring-group 1 mirroring-port ten1/0/46 both
mirroring-group 1 monitor-egress ten2/0/2

Hardware HP 5900AF-48XG-4QSFP+ Switch

Operating system HP Comware 7.1.045 2311P01

[HP-5900-Stack]display mirroring-group 1
Mirroring group 1:
    Type: Remote source
    Status: Active
    Mirroring port:
        Ten-GigabitEthernet1/0/46  Both
    Monitor egress port: Ten-GigabitEthernet2/0/2
    Remote probe VLAN: 50

[HP-5900-Stack]

Does anyone have a solution to this issue ??

 

Regards, Daniel