• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2786
  • Last Modified:

Cisco 3550 / SPAN / Sniffing - IP of sniffer

Got a quick question (it's after hours, network admins not around, and I'm impatient and would like to have a traffic analyzer in place in the morning).

Here's the deal: Cisco 3550 switch, port 1 connected to PIX firewall (which all network traffic flows through), and a SPAN session created between port 1 and 48.

My initial thoughts were that if I slapped a W2K3 server in there, connected one of its NICs to port 48, and assigned it an IP address, subnet mask, and blank gateway, that it would sit there quietly and Ethereal would display all the blinky traffic that the NIC sees. I can visually see that ports 1 and 48 have a lot of activity on them and that the NIC's RX light is going nuts, too. However, I can see in the Windows Status window for the interface that it is sending packets (verified with Ethereal, it's trying to send out broadcasts), but receiving 0 packets (verified this with Ethereal too, but wasn't real hard. :)) No firewall, IPsec rules, RRAS or anything applied to that NIC.

The only piece in the puzzle that I'm clueless about is the actual IP address of the PIX interface (so I'm guessing as to which subnet it might be on and assigning the W2K3 NIC an address in that subnet).

I could guess that ingress traffic is disabled on that Cisco span session since the NIC can't even get DHCP, but still, I would think there would be some way for Ethereal to see all traffic on an interface regardless of the IP address configuration of the interface. Am I thinking correctly?

What gives? (and yes, I have kicked it multiple times already with no change.)

1 Solution
Ethereal needs another piece (PCAP?) to put the NIC into promiscuous mode and actually capture packets.  Have you done that?

If your SPAN config is correct, packets in/out of port 1 will be copied to port 48.  So either (a) your config isn't correct -- show us, please?, or (b) the PC isn't listening to the packets that come to the port.  (With some sniffers, the sniffing interface doesn't need an IP address, etc, assigned, and in fact works better without -- not sure whether this is true of Ethereal.)

BrandonPotterAuthor Commented:
Promiscuous mode was not turned on, so that was indeed the problem! Always those little check boxes that get you into trouble. :)

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Managed Security Services Webinar - March 15

Selecting the right managed security services platform to grow your business can be a huge undertaking. Join WatchGuard and Frost & Sullivan in an upcoming webinar as we dive into the key elements of selecting a vendor platform and partnership to fuel a successful MSSP business.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now