What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

Sniffer only seeing broadcast traffic

Votes:

0

Hello,

I am testing out the sniffer sensor and have it configured in the following way:

Configured port mirroring (spanning)

The server setup is a sVM on hyper V server with several nics. One nic is dedicated for PRTG management, host access etc.

The second nic is dedicated to the sniffer and is plugged into port on our cisco 3750 with port mirroring configured.

Essentially this hyper v host has 2 virtual switches that have a dedicated nic on each virtual switch.

Cisco port config

Port being monitored 

interface GigabitEthernet1/0/1
 description Uplink to internet egress
 switchport mode access
 speed 100
 duplex full

Destination port:
interface GigabitEthernet1/0/3
 description SFS-NETMON Mirror P1
 switchport mode access

Spanning config 
monitor session 1 source interface Gi1/0/1
monitor session 1 destination interface Gi1/0/3

The port it is monitoring is our uplink to our MPLS provider

My expectation is to see source and destination of all packets. All i am seeing is local traffic and appears to be broadcast traffic.

Should the nic have an IP address? What am i missing?

Thanks in advanced

Jason

cisco packet-sniffer port-mirroring

Created on Jun 27, 2012 2:01:21 AM

Last change on Jun 28, 2012 1:29:08 PM by Torsten Lindner [Paessler Support]



5 Replies

Votes:

0

Hello,

just to check, is the NIC (its driver) running in promiscuous mode? If not, the situation would exactly as described, so PRTG seeing only local traffic.

best regards.

Created on Jun 28, 2012 1:30:11 PM by Torsten Lindner [Paessler Support]



Votes:

0

How do i put the nic in promiscous mode? Do I do this on the hyper v host or in the guest?

Thanks

Created on Jun 28, 2012 2:30:55 PM



Votes:

0

Usually it is locally set (so in the guest), but with Virtual Systems you may need to set it also on the host-system.

Created on Jun 28, 2012 3:02:31 PM by Torsten Lindner [Paessler Support]



Votes:

0

Is this something that is set in nic properties? I cannot seem to find that setting anywhere on the NIC

Created on Jun 28, 2012 5:01:39 PM



Votes:

0

another way to cause this, even when the card is in the correct mode, is if the hub you are plugged into is actually a switch, that is not uncommon with 100 mb hubs, especially those that include NAT/WAN services, in this case there may be some special ports to configure on the switch to replicate traffic, if not it might be necessary to install an intermediate hub on the segment you wish to sniff

Created on Nov 29, 2020 1:15:41 PM




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.