Have configured SPAN on a Catalyst 2950 (the source port is the same port connecting our firewall device to the LAN), and connected the second nic on the server running PRTG Network Monitor to the destination port.
Is there any trick to configuring ip settings for that second nic? I at first had it obtain ip by dhcp and it defaulted to the 169.254.x.x range. I then gave it an ip in our subnet range 172.16.1.0/24.
Also, I'm ONLY seeing UDP traffic to port 138 from my Packet Sniffer sensor.
Feeling like I've missed a basic step - any help would be greatly appreciated!