Unanswered Question
Jun 12th, 2008
User Badges:
  • Purple, 4500 points or more

I think the answer is no , but is there anyway to setup a span session to a local pc with sniffer software on it and still be able to get to that pc via the network ? I believe span disables any outgoing traffic . I believe this will be a manual deal but just wanted to run this by everyone.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
michael.leblanc Thu, 06/12/2008 - 15:26
User Badges:
  • Silver, 250 points or more

I would concur with your opinion.

The answer probably lies in the fact that the sniffer is connected to a SPAN "Destination" interface.

Although I typically unbind the IP stack from the NIC used for Wireshark packet capture, I did the following a few minutes ago:

Note: My SPAN source interface is the trunk port used for inter-VLAN routing.

I configured the sniffer NIC with a static IP, then tried to ping a host on another network to verify that the sniffer NIC could place packets on the wire, and that my IP was what I expected.

I saw the sniffer NIC try to ARP its default gateway, but the gateway did not respond.

Then I tried to ping the sniffer NIC from a host on another network. I saw the local gateway ARP my sniffer NIC, but the NIC did not respond.


This Discussion