Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Wireshark not capturing traffic from SPAN port

I am trying to use a workstation with Wireshark on it to capture the traffic to/from another workstation on the network.  The goal is to view all traffic that takes place to this one machine during network imaging.

So I set up the SPAN session on the Cisco WS-3750-48P [12.2(55)SE7].  Fairly simple.

monitor session 1 source interface fastEthernet1/0/1 (workstation we are imaging)

monitor session 1 destination interface fastEthernet1/0/2 (workstation with Wireshark)

I ensure the SPAN session on the switch (show monitor session 1 detail).  I also ensure that the monitoring machine is plugged into the correct port (f1/0/2).

I fire up Wireshark, choose the NIC, ensure 'promiscuous mode' and then start the capture.  The machine is a Dell Optiplex 760 running Windows 7 Enterprise.  NIC: Intel 82567LM-3 Gigabit

Then we start the PXE boot and the target machine is off & running; imaging as normal.

Nothing but a handful of local (my machine) ARPs and a few UDP lines in the Wireshark window.  I see nothing to/from the other machine (the mirrored port).

Any thoughts on why Wireshark is not picking up this traffic?  Where can I start trouble-shooting.  I have been trying to get to the Wireshark pages but that's a no-go as of right now.  I cannot give any screen shots of this.

Any help is appreciated.

8 REPLIES
New Member

Hello, Could you post the

Hello,

 

Could you post the port configurations for F1/0/1 -  2.

It could help,

 

Thanks :)

New Member

Certainly,Both ports were

Certainly,

Both ports were configured the same.  When I set up the session, I also checked the 'show int status' output and fastEthernet 1/0/1 was in 'MONITOR' status.

 

interface fastEthernet1/0/1 - 2

  switchport mode access

  switchport access vlan 65

  spanning-tree portfast

  spanning-tree bpduguard enable

  no shut

 

Should the configuration be defaulted when setting up a monitor session?

Again, I appreciate any help.

New Member

On destination port, in your

On destination port, in your case fa-1/0/2 should have just one command.

int fa 1/0/2

switchport

no shut

New Member

Seems like monitor mode is

Seems like monitor mode is not enabled in the network card driver:

 

http://www.intel.com/support/network/sb/cs-005897.htm

 

New Member

Okay.  I will default the

Okay.  I will default the port next time around, set just the 'switchport' and 'no shut' commands for the destination port.

I will also begin reading up on the Intel NIC from the posted link.  Hopefully we are allowed to make those changes.

Thank you both for the assistance.  It may take me a few but I will try this again and report back.

New Member

Hi,VPN & other software

Hi,

VPN & other software utilities can interfere with the TCP/IP stack on your machine and result in Wireshark not capturing the traffic properly. I experienced this when Checkpoint VPN software was loaded on the m/c I was using ... as soon as it was disabled, Wireshark captured all traffic. Something to look into.

Cheers,

Steve

New Member

I had the same problem. I

I had the same problem. I could see from the switch interface statistics that the data was being forwarded and the raw bytes received count on my laptop's NIC was going up, but Wireshark was only showing a small fraction of the traffic. Turned out Symantec's Network Threat Protection was filtering out all the data. I turned off Symantec and was immediately flooded with the traffic I was looking for. Hopefully it is that simple for OP.

Purple

  Make sure the Windows 7

  Make sure the Windows 7 firewalls are turned off .

2839
Views
0
Helpful
8
Replies
CreatePlease to create content