Solved

Cisco 3550 / SPAN / Sniffing - IP of sniffer

Posted on 2004-04-28
2
2,771 Views
Last Modified: 2008-02-01
Got a quick question (it's after hours, network admins not around, and I'm impatient and would like to have a traffic analyzer in place in the morning).

Here's the deal: Cisco 3550 switch, port 1 connected to PIX firewall (which all network traffic flows through), and a SPAN session created between port 1 and 48.

My initial thoughts were that if I slapped a W2K3 server in there, connected one of its NICs to port 48, and assigned it an IP address, subnet mask, and blank gateway, that it would sit there quietly and Ethereal would display all the blinky traffic that the NIC sees. I can visually see that ports 1 and 48 have a lot of activity on them and that the NIC's RX light is going nuts, too. However, I can see in the Windows Status window for the interface that it is sending packets (verified with Ethereal, it's trying to send out broadcasts), but receiving 0 packets (verified this with Ethereal too, but wasn't real hard. :)) No firewall, IPsec rules, RRAS or anything applied to that NIC.

The only piece in the puzzle that I'm clueless about is the actual IP address of the PIX interface (so I'm guessing as to which subnet it might be on and assigning the W2K3 NIC an address in that subnet).

I could guess that ingress traffic is disabled on that Cisco span session since the NIC can't even get DHCP, but still, I would think there would be some way for Ethereal to see all traffic on an interface regardless of the IP address configuration of the interface. Am I thinking correctly?

What gives? (and yes, I have kicked it multiple times already with no change.)

Thanks,
Brandon
0
Comment
Question by:BrandonPotter
2 Comments
 
LVL 11

Accepted Solution

by:
PennGwyn earned 500 total points
ID: 10944456
Ethereal needs another piece (PCAP?) to put the NIC into promiscuous mode and actually capture packets.  Have you done that?

If your SPAN config is correct, packets in/out of port 1 will be copied to port 48.  So either (a) your config isn't correct -- show us, please?, or (b) the PC isn't listening to the packets that come to the port.  (With some sniffers, the sniffing interface doesn't need an IP address, etc, assigned, and in fact works better without -- not sure whether this is true of Ethereal.)

0
 

Author Comment

by:BrandonPotter
ID: 10944600
Promiscuous mode was not turned on, so that was indeed the problem! Always those little check boxes that get you into trouble. :)

Thanks!
Brandon
0

Featured Post

Connect further...control easier

With the ATEN CE624, you can now enjoy a high-quality visual experience powered by HDBaseT technology and the convenience of a single Cat6 cable to transmit uncompressed video with zero latency and multi-streaming for dual-view applications where remote access is required.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ASA5510 Blocking a Wanted Website/Host 9 25
Need network only 1 user? 10 67
Internet options/Settings 1 45
IR 1023 Scanning 4 22
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question