Hello, I'm running into some difficulties configuring port mirroring on a Dell Power Connect 3548. We are running surf control web filtering software on a file server that's running Windows Server 2003. I'm trying to use port mirroring so that all the traffic going to our gateway gets mirrored to the server and monitored (to avoid having to use a hub instead). I got the source port on the switch configured (the gateway, port 1) and the destination port configured (the Windows Server, port 2). There are two NIC's on the server, both plugged into our LAN. The one NIC I left as is and the other NIC is plugged into the mirrored port. I tried disabling the all the settings under the NIC properties and it doesn't show it's connected on the server, however on the switch it does. I unchecked Client for Microsoft Networks, File and Print Sharing for MS Networks, and TCP/IP. The only box I left checked in the NIC properties is the Surf Control Network Protocol Device Driver.
I was under the impression that mirrored port cannot have a TCP/IP configuration, if so how does it connect to the switch? I even tried leaving TCP/IP check to see if DHCP negotiate anythign with the switch but it didn't(we're running an entirely static network). I also tried changing the port setting on the switch to 100 full no negotiation and made the settings the same on the NIC and no such luck. Like I said before, it shows it's connected on the switch but the server is showing no connection and nothing is being filtered by Surf Control. Am I missing something or doing something wrong? Thank you!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
The blocking adapter can be the same NIC as the regular NIC. I believe there should have something like "blocking adapter" settings in surf control.
To confirm whether port mirroring is properly set, you may check the status of the monitoring NIC in "Control Panel"->"network settings" of your windows system. Upon correct port mirroring settings, you will be able to see huge number of "Received" packets even this NIC is not connected to network.
That did it! Thanks. I had the port mirroring set up properly on the switch, just needed to configure the surfcontrol protocol on the NICs. For future reference for anyone else to use here's the exact steps-
1. Set up a source and destination port (mirrored port) on the switch for both TX and RX.
2. Plugged the gateway (or router) into the source port
3. Plugged the first NIC on the serverinto any port on the switch and configure it with typical TCP/IP settings.
4. Plugged the second NIC on the server into the destination port (mirrored port)
5. Went into the second NIC properties and unchecked every protocol EXCEPT the surfcontrol monitoring protocol.
6. Changed the properties in the surf control monitoring protocol on that NIC to monitor traffic and forward blocking to the other NIC in the server that is configure for the network.
Hope this helps anyone in a similar situation. Thanks again!
Business Accounts
Answer for Membership
by: buenit10Posted on 2009-09-08 at 18:37:01ID: 25287656
I forgot to add that source port is set to forward both TX and RX packets.