Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Wireshark on HP Procurve switch

Posted on 2012-03-20
3
Medium Priority
?
2,937 Views
Last Modified: 2012-03-21
I'm trying to run Wireshark 1.6.5 to monitor all VLAN traffic going to the web by IP address through an HP Procurve 4208vl switch. The PC running Wireshark is in a switch port set to monitor the LAN-side switch port of the web filter.

I see packets, but only from one VLAN. I set the port I'm using with the Wireshark PC (Port 1) to monitor the web filter LAN-side switch port (port 2). I can go into the switch config and change port 2 to VLAN-A (192.168.1.0) and see only the 192.168.1.0 traffic. If I change the port to 192.168.2.0 untagged I only see 192.168.2.0 traffic.

How can I configure the Procurve to see all VLAN traffic on the monitor port?
0
Comment
Question by:IntPack
3 Comments
 
LVL 17

Assisted Solution

by:jburgaard
jburgaard earned 600 total points
ID: 37744091
I must admit I have not tryed this, but I am confident
on the procurve-port leading to sniffer you must tag all vlans you want to look at and
the NIC must be able to handle the tagged packets.
http://wiki.wireshark.org/CaptureSetup/VLAN 

HTH
0
 
LVL 5

Accepted Solution

by:
Frank Mayer earned 1400 total points
ID: 37746544
Hi check the documentation here:
http://www.hp.com/rnd/support/manuals/4200vl.htm
When wading though the manuals i found you can only mirror one VLAN directly with the 4200 switch. So what you should do is mirroring per port and mirror those ports you want to look at to the designated port. It is described in the above manuals.
0
 

Author Closing Comment

by:IntPack
ID: 37747189
Thanks for the help. This is what I thought it was going to be but I just didn't find it in the manual.
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

#Citrix #Netscaler #MSSQL #Load Balance
Is your computer hacked? learn how to detect and delete malware in your PC
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Suggested Courses

824 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question