I am testing out the sniffer sensor and have it configured in the following way:
Configured port mirroring (spanning)
The server setup is a sVM on hyper V server with several nics. One nic is dedicated for PRTG management, host access etc.
The second nic is dedicated to the sniffer and is plugged into port on our cisco 3750 with port mirroring configured.
Essentially this hyper v host has 2 virtual switches that have a dedicated nic on each virtual switch.
Cisco port config Port being monitored interface GigabitEthernet1/0/1 description Uplink to internet egress switchport mode access speed 100 duplex full Destination port: interface GigabitEthernet1/0/3 description SFS-NETMON Mirror P1 switchport mode access Spanning config monitor session 1 source interface Gi1/0/1 monitor session 1 destination interface Gi1/0/3
The port it is monitoring is our uplink to our MPLS provider
My expectation is to see source and destination of all packets. All i am seeing is local traffic and appears to be broadcast traffic.
Should the nic have an IP address? What am i missing?
Thanks in advanced