["McNutt, Justin M." <McNuttJ@xxxxxxxxxxxx>]

Do a 'dmesg | grep promisc' and make sure the interface is actually going into promiscuous mode.  Also check the output of 'ifconfig -a'.  You should see confirmation there as well.

 

But I'll bet that the problem is that the port mirror is not set up correctly, or that the port mirror is not working.  There have been several versions of code in which port mirrors act strangely...

 

--J

-----Original Message-----
From: Mike Kelley [mailto:MikeK@xxxxxxxxx]
Sent: Wednesday, September 10, 2003 4:41 PM
To: 'ethereal-users@xxxxxxxxxxxx'
Subject: [Ethereal-users] mirrored/monitored/SPAN'd port not working

 

 

I've spent over 8 hours researching and trying and RTFM'ing ... I had my network admin mirror a port on our cisco switch. When I sniff the port all I get is the broadcast messages or local traffic

 

I have read

http://www.ethereal.com/faq.html#q5.1

 over and over ... I have manually (ifconfig ...) put the interfaces into promiscuous mode.

 

What next to trouble shoot?

 

Thanks in advance

 

Mike