use of port monitor (SPAN)

[tato386]

The port monitor command seems pretty straightforward but I can't seem to get it to work using a Windows 2K station running the MS network monitor utility. I would like to monitor all of the interfaces on a 2900XL switch from the interface that my Windows machine is on but I only get local and broadcast packets. I have entered the port monitor fax/y command for all other ports under the config of the Windows port but still no data. What else do I need to do?

Thanks,

Diego

[dgahm]

Do the "show interface" counters on the monitoring port indicate the amount of output traffic you are expecting?

The problem may be with your PC. The NIC needs to be operating in promiscuous mode in order to capture all frames. I am a NAI Sniffer guy myself, so am not very familiar with the MS network monitor (though I hear it is pretty limited). Are there any config settings that might allow you to select promiscuous? The default may be to just look at frames with your MAC address as well as broadcast. You might want to do some research on WinPcap, and the other freeware IDS and monitoring utilities that work with it.

It is also well known that many NIC models will not operate promiscuously. You may have one of those.

[tato386]

I will investigate the NIC further.

Thanks,

Diego