Wireshark · Ethereal-users: RE: [Ethereal-users] mirrored/monitored/SPAN'd port not working

[Mike Kelley <MikeK@xxxxxxxxx>]

This is what I get from "dmesg | grep promisc" & "ifconfig -a"  eth0 is the
one currently plugged into a hub with the target but it is also the
interface I have used plugged into the FE 0/8 that is monitoring FE 0/3


<SNIP>
!
interface FastEthernet0/3
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 11
 switchport mode trunk
 switchport voice vlan 111
!
<SNIP>
!
interface FastEthernet0/8
 port monitor FastEthernet0/3
!
<SNIP>

Las_Cruces3524_1#sh port monitor
Monitor Port           Port Being Monitored
---------------------  ---------------------
FastEthernet0/8        FastEthernet0/3

<SNIP>



[spike@localhost spike]$ dmesg | grep promisc
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
eth0: Setting promiscuous mode.
eth0: Setting promiscuous mode.
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
eth0: Setting promiscuous mode.
eth0: Setting promiscuous mode.
eth0: Setting promiscuous mode.
eth0: Setting promiscuous mode.
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
device eth1 entered promiscuous mode
device eth1 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
[spike@localhost spike]$ /sbin/ifconfig -a
cipsec0   Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          BROADCAST MULTICAST  MTU:1400  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
 
eth0      Link encap:Ethernet  HWaddr 00:08:74:
          inet addr:192.168.11.73  Bcast:192.168.11.255 
Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:576557 errors:0 dropped:0 overruns:0 frame:0
          TX packets:49 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:43357674 (41.3 Mb)  TX bytes:7734 (7.5 Kb)
          Interrupt:11 Base address:0xec80
 
eth1      Link encap:Ethernet  HWaddr 00:40:05:
          inet addr:192.168.11.81  Bcast:192.168.11.255 
Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:333129 errors:0 dropped:0 overruns:0 frame:0
          TX packets:124925 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:31761378 (30.2 Mb)  TX bytes:12228323 (11.6 Mb)
          Interrupt:11 Base address:0xb000
 
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:565755 errors:0 dropped:0 overruns:0 frame:0
          TX packets:565755 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:38652246 (36.8 Mb)  TX bytes:38652246 (36.8 Mb)
 
[spike@localhost spike]$ /sbin/ifconfig eth0 -promisc
SIOCSIFFLAGS: Permission denied
[spike@localhost spike]$ su
Password:
[root@localhost spike]# /sbin/ifconfig eth0 promisc
[root@localhost spike]# /sbin/ifconfig eth1 promisc
[root@localhost spike]# /sbin/ifconfig -a
cipsec0   Link encap:Ethernet  HWaddr 00:00:00:00:00:00
          BROADCAST MULTICAST  MTU:1400  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
 
eth0      Link encap:Ethernet  HWaddr 00:08:74:
          inet addr:192.168.11.73  Bcast:192.168.11.255 
Mask:255.255.255.0
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:577043 errors:0 dropped:0 overruns:0 frame:0
          TX packets:49 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:43394448 (41.3 Mb)  TX bytes:7734 (7.5 Kb)
          Interrupt:11 Base address:0xec80

-- 
Mike 


-----Original Message-----
From: McNutt, Justin M. [mailto:McNuttJ@xxxxxxxxxxxx] 
Sent: Thursday, September 11, 2003 9:53 AM
To: ethereal-users@xxxxxxxxxxxx
Subject: RE: [Ethereal-users] mirrored/monitored/SPAN'd port not working

Do a 'dmesg | grep promisc' and make sure the interface is actually going
into promiscuous mode.  Also check the output of 'ifconfig -a'.  You should
see confirmation there as well.
 
But I'll bet that the problem is that the port mirror is not set up
correctly, or that the port mirror is not working.  There have been several
versions of code in which port mirrors act strangely...
 
--J
-----Original Message-----
From: Mike Kelley [mailto:MikeK@xxxxxxxxx]
Sent: Wednesday, September 10, 2003 4:41 PM
To: 'ethereal-users@xxxxxxxxxxxx'
Subject: [Ethereal-users] mirrored/monitored/SPAN'd port not working


I've spent over 8 hours researching and trying and RTFM'ing ... I had my
network admin mirror a port on our cisco switch. When I sniff the port all I
get is the broadcast messages or local traffic

I have read 
http://www.ethereal.com/faq.html#q5.1
 over and over ... I have manually (ifconfig ...) put the interfaces into
promiscuous mode. 

What next to trouble shoot?

Thanks in advance

Mike