Hi i have some problems. i use port mirroring and wireshark. I want to do it on my main computer and monitor my second. But when i use wireshark i dont get much. I unchecked everything in my ethernet properties so that i only receive data from the secod computer. Is there anything else which i need to do with my first pc so that it will receive the data? I use WIn 7. When i try wireshark to monitor the data on the first pc it works fine. It just lookes that i dont "see" the data from the the second or at least only a small part of it. Btw the port mirroring is correctly checked it mantimes. Thank You! asked 11 Jan '15, 02:37  MaxMoritz |
One Answer:
This looks like a typical SPAN port misconfiguration. Have you configured source port and destination ports correctly (they are often swapped by mistake)? It's usually not enough just to enable mirroring on the switch, but you also need to tell the switch which ports you want to have copied where. Other than that, make sure that when you capture your checkmark for "Use Promiscuous mode" is active in the capture options dialog, because otherwise your first PC will not accept packets that are not meant for it's network card. answered 11 Jan '15, 05:53  Jasper ♦♦ |
