Solved

Cisco 3550 / SPAN / Sniffing - IP of sniffer

Posted on 2004-04-28
2
2,774 Views
Last Modified: 2008-02-01
Got a quick question (it's after hours, network admins not around, and I'm impatient and would like to have a traffic analyzer in place in the morning).

Here's the deal: Cisco 3550 switch, port 1 connected to PIX firewall (which all network traffic flows through), and a SPAN session created between port 1 and 48.

My initial thoughts were that if I slapped a W2K3 server in there, connected one of its NICs to port 48, and assigned it an IP address, subnet mask, and blank gateway, that it would sit there quietly and Ethereal would display all the blinky traffic that the NIC sees. I can visually see that ports 1 and 48 have a lot of activity on them and that the NIC's RX light is going nuts, too. However, I can see in the Windows Status window for the interface that it is sending packets (verified with Ethereal, it's trying to send out broadcasts), but receiving 0 packets (verified this with Ethereal too, but wasn't real hard. :)) No firewall, IPsec rules, RRAS or anything applied to that NIC.

The only piece in the puzzle that I'm clueless about is the actual IP address of the PIX interface (so I'm guessing as to which subnet it might be on and assigning the W2K3 NIC an address in that subnet).

I could guess that ingress traffic is disabled on that Cisco span session since the NIC can't even get DHCP, but still, I would think there would be some way for Ethereal to see all traffic on an interface regardless of the IP address configuration of the interface. Am I thinking correctly?

What gives? (and yes, I have kicked it multiple times already with no change.)

Thanks,
Brandon
0
Comment
Question by:BrandonPotter
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 11

Accepted Solution

by:
PennGwyn earned 500 total points
ID: 10944456
Ethereal needs another piece (PCAP?) to put the NIC into promiscuous mode and actually capture packets.  Have you done that?

If your SPAN config is correct, packets in/out of port 1 will be copied to port 48.  So either (a) your config isn't correct -- show us, please?, or (b) the PC isn't listening to the packets that come to the port.  (With some sniffers, the sniffing interface doesn't need an IP address, etc, assigned, and in fact works better without -- not sure whether this is true of Ethereal.)

0
 

Author Comment

by:BrandonPotter
ID: 10944600
Promiscuous mode was not turned on, so that was indeed the problem! Always those little check boxes that get you into trouble. :)

Thanks!
Brandon
0

Featured Post

Visualize your virtual and backup environments

Create well-organized and polished visualizations of your virtual and backup environments when planning VMware vSphere, Microsoft Hyper-V or Veeam deployments. It helps you to gain better visibility and valuable business insights.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I had an issue with InstallShield not being able to use Computer Browser service on Windows Server 2012. Here is the solution I found.
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Suggested Courses

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question