This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Receive only broadcast in mirrored port

0

I'm connected on a switch where my port receive traffic of another port monitored. I have tried Wireshark on my Window7 laptop and also with a Fedora LiveCD in another laptop. The only packets I see is broadcast multicast packets.

Also with other laptop and older version of Wireshark I get only broadcast and multicast packets or packets directed to the local pc. Nothing from the port monitored!

Also tried with an old hub..

What can I check: i'm using promiscuos mode and wired interfaces..

ADDITIONAL INFO: One partner is a gigabit eth of laptop, the other is a linux server in gigabit. The two cables are connected to a SIXNET Managed switch 10/100 and the laptop connected to monitoring port is a gigabit eth laptop.

Trying with tcpdump doesn't change anything.

The two hubs tried are made by a "non-commercial" vendor but are 10/100.

asked 05 Sep '13, 04:34

MauroDx's gravatar image

MauroDx
1112
accept rate: 0%

edited 08 Sep '13, 23:38

what's the speed of the monitored port? what's the make and model of the hub? you can check if port span was set up to mirror both RX & TX

(05 Sep '13, 11:02) net_tech

Try also using Microsoft Network Monitor on your Windows machine and tcpdump on the Fedora LiveCD machine, but I suspect they probably won't work any better; it's probably an issue with the configuration of the switch, as net_tech suggested.

(05 Sep '13, 17:58) Guy Harris ♦♦

The two cables are connected to a SIXNET Managed switch 1

can you please post the screenshot of the port mirroring configuration? Maybe there is a problem with that!?!

Also tried with an old hub..

well, that makes a config problem less likely.

(09 Sep '13, 01:58) Kurt Knochner ♦