Montoring VLANs

[brandonc]

Hello,

I have a ProCurve 2626, firmware version H.08.60, ROM version H.08.02. One of the ports on this switch is a WAN link to my colo site. It is passing 3 VLANS: VLAN1 is Untagged, VLANs 2 & 3 are Tagged. I need to monitor all traffic on this port to assess bandwidth usage over the WAN link. I have enabled port monitoring, configured a monitor port, and set the WAN port to mirror traffic to the monitor port. Here is the config:

Switch# sh mon

Network Monitoring Port

Mirror Port: 1

Monitoring sources
------------------
26

However, on my analyzer, connected to the monitoring port (1), I only see traffic from any one VLAN, and only if the monitor port is an Untagged port in that VLAN. For example, if port 1 is configured in VLAN1 Untagged, VLAN2 Tagged, VLAN3 Tagged, the analyzer only sees traffic from VLAN1. If port 1 is VLAN1 Tagged, VLAN2 Untagged, VLAN3 Tagged, it only sees traffic from VLAN2.

To asses total bandwidth, I need to analyze traffic from all 3 VLANS. Any insight appreciated.

Thanks!

[Matt Hobbs · Accepted solution]

Most likely the other VLANs are being mirrored and are including the 802.1Q tag - and your NIC is discarding these packets.

Usually you can fix this by a few registry edits for your NIC: http://wiki.wireshark.org/CaptureSetup/VLAN

[brandonc]

Thanks Matt,

With that tip I have isolated the issue to the NIC on the analyzer.