This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Configured a monitor port on the switch. Connected to this port. Only seeing Local IP traffic

Anyone help me configure this as I most be doing something wrong.

asked 09 Jun '17, 09:36

lslifkin's gravatar image

lslifkin
6112
accept rate: 0%

'The switch' is a rather generic indication of the networking equipment we are supposed to help you with... Last time I checked we're not psychic, so you've got to tell us exactly what you're working with and what you're doing.

(09 Jun '17, 10:14) Jaap ♦

The switch is a HPE 1920 48Port PoE+ switch. Port 23 has been configured as the Monitor Port. When I start a capture, it seems that 90% of all traffic is the laptop that I am connected to. Want to exclude that in the capture and look to get VoIP traffic logged

(09 Jun '17, 12:00) lslifkin

This may be obvious but make sure: - Span port is correctly configured - In wireshark make sure you enable promiscuous mode on the capturing interface

You may want to remove any capture filters just in case there's an error in it.

(09 Jun '17, 12:12) jerioux

In addition to defining a monitor port - the port(s) to monitor - you have to define a mirror port (where to send the traffic). Something like:

; Monitor these ports
interface 3-4,7-9,18,27,31,37
   monitor
   exit
; Send the data to here
mirror-port 24
permanent link

answered 13 Jun '17, 06:30

dbAtAffirmed's gravatar image

dbAtAffirmed
6113
accept rate: 0%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×238
×139
×109
×8

question asked: 09 Jun '17, 09:36

question was seen: 906 times

last updated: 13 Jun '17, 06:30

p​o​w​e​r​e​d by O​S​Q​A