Port Mirroring on 5500 Switch

[jsuoh]

Seen a couple of posts about this before but with no solution, so wondering if anyone is having similar problems.

I have configured port mirroring on a HP A5500 switch port (g1/0/12) to mirror both directions, and then a seperate port as the monitor port (g1/0/47). The problem is I only appear to see traffic going in one direction (inbound on g1/0/12), and i cant see anything going outbound (Eg. When analysing DHCP Handshake, i only see DHCPDISCOVER and DHCPREQUEST, even though the machine on the end of g1/0/12 has obtained an IP address sucessfully).

Below is the mirroring group config.

mirroring-group 1:
type: local
status: active
mirroring port:
GigabitEthernet1/0/12 both
monitor port: GigabitEthernet1/0/47

Switch software version:

HP Comware Platform Software
Comware Software, Version 5.20.99, Release 2221P08

[Vince-Whirlwind]

Do you have your Wireshark set to "promiscuous"?

[jsuoh]

Yes, its set to promiscuous.

[Vince-Whirlwind]

Some security applications replace your TCP/IP stack when you install them and prevent promiscuous from working.

I had this with McAfee, from memory.

[jsuoh]

Its strange, I can mirror off other devices without any problems, and i have tried multiple devices on the 5500.

[Vince-Whirlwind]

In that case it must be the switch.

I would remove the mirror-port config, reboot the switch (if possible - maybe schedule a "vital firmware upgrade, for security reasons") then re-add it, maybe using a different mirror-group.

[drolfe]

It's not the switch, as I have the exact same issue, I can see inbound from the internet but not outbound

mirroring-group 1 remote-source
vlan 50
mirroring-group 1 remote-probe vlan 50
mirroring-group 1 mirroring-port ten1/0/46 both
mirroring-group 1 monitor-egress ten2/0/2

Hardware HP 5900AF-48XG-4QSFP+ Switch

Operating system HP Comware 7.1.045 2311P01

[HP-5900-Stack]display mirroring-group 1
Mirroring group 1:
    Type: Remote source
    Status: Active
    Mirroring port:
        Ten-GigabitEthernet1/0/46  Both
    Monitor egress port: Ten-GigabitEthernet2/0/2
    Remote probe VLAN: 50

[HP-5900-Stack]

Does anyone have a solution to this issue ??

Regards, Daniel

[Pongsatorn_YIT]

Hi Daniel,

        Do you solve issue or not?. I have the same issue on HP A5500.