I'm connected on a switch where my port receive traffic of another port monitored. I have tried Wireshark on my Window7 laptop and also with a Fedora LiveCD in another laptop. The only packets I see is broadcast multicast packets. Also with other laptop and older version of Wireshark I get only broadcast and multicast packets or packets directed to the local pc. Nothing from the port monitored! Also tried with an old hub.. What can I check: i'm using promiscuos mode and wired interfaces.. ADDITIONAL INFO: One partner is a gigabit eth of laptop, the other is a linux server in gigabit. The two cables are connected to a SIXNET Managed switch 10/100 and the laptop connected to monitoring port is a gigabit eth laptop. Trying with tcpdump doesn't change anything. The two hubs tried are made by a "non-commercial" vendor but are 10/100. asked 05 Sep '13, 04:34  MauroDx edited 08 Sep '13, 23:38 |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
what's the speed of the monitored port? what's the make and model of the hub? you can check if port span was set up to mirror both RX & TX
Try also using Microsoft Network Monitor on your Windows machine and tcpdump on the Fedora LiveCD machine, but I suspect they probably won't work any better; it's probably an issue with the configuration of the switch, as net_tech suggested.
can you please post the screenshot of the port mirroring configuration? Maybe there is a problem with that!?!
well, that makes a config problem less likely.