Switches, Hubs, and Modems
cancel
Showing results for 
Search instead for 
Did you mean: 

Monitoring Port on Procurve 26XX series

M.Aanstoot
Occasional Contributor

Monitoring Port on Procurve 26XX series

Hi,

I have enabled monitoring on some ports on HP Procurve 26xx switches. When I capture traffic with Tcpdump or Wireshark with promiscuous mode on the port which I have mirrored the traffic from the monitored port it seems that no traffic is captured. The monitored port is the LAN interface connected to the router and I was expecting to see all traffic coming from the router tor the clients. Maybe my assumption is not correct ? Is there something else I need to configure before I see all the traffic ?

Part of the config:

mirror-port 23

interface 25
monitor
exit

Thanks for any response,

regards,

Mike
4 REPLIES
cenk sasmaztin
Honored Contributor

Re: Monitoring Port on Procurve 26XX series

can you see any eror on this port's
cenk

Jeff Carrell
Honored Contributor

Re: Monitoring Port on Procurve 26XX series

hmmm...

is this a 2650? if so, "On the 2650/2650-PWR switches, ports are grouped as follows: 1-24 + 49, and 25-48 + 50".....this is from the manual, mgmt/appx b...

otherwise, config is simple, what you have should work...

hth...jeff
cenk sasmaztin
Honored Contributor

Re: Monitoring Port on Procurve 26XX series

please send me sh log print your switch
cenk

Pieter 't Hart
Honored Contributor

Re: Monitoring Port on Procurve 26XX series

check if you got the direction right.
interface 25 is the source port were the router is connected?
and interface 23 is the destination where the wireshark station is connected ?

do you use vlan-tagging at the router port?
then this tag may still be present in the monitored packets and your monitoring station must be able to process vlan-tagged packets.

from the 2610 Management and Configuration Guide :

VLAN-Related Problems
Monitor Port. When using the monitor port in a multiple VLAN environment,
the switch handles broadcast, multicast, and unicast traffic output from the monitor port as follows:
â  
If the monitor port is configured for tagged VLAN operation on the same VLAN as the traffic from monitored ports, the traffic output from the monitor port carries the same VLAN tag.
â  
If the monitor port is configured for untagged VLAN operation on the same VLAN as the traffic from the monitored ports, the traffic output from the monitor port is untagged.
â  
If the monitor port is not a member of the same VLAN as the traffic from the monitored ports, traffic from the monitored ports does not go out the monitor port.

hth
Pieter