Bill,
That's exactly what I've done. Without the system being a monitor,
capturing packets while browsing the Internet displays packets as I expect.
-Chad
Bill Baltas said the following on 10/10/2007 1:30 PM:
> Chad,
>
> Your capture ports look okay. Could you have a capture filter defined in Wireshark?
> Also, are you sure the capture workstation is not working properly.
>
> One easy way to check the workstation is to turn off the capture to the
> destination port (no monitor session 1 destination interface Gi0/22). Give
>
> this PC an IP address, turn on wireshark and browse the Internet. You should
> see all of the TCP traffic to and from this machine. If you get the same
> results as before, its a problem with your machine or your wireshark configuration.
>
> Good Luck
> Bill Baltas
>>I'm currently using version 0.99.6 on a Windows platform.
>>
>>I have the following configuration set up on my Cisco 3560 switch.
>>
>>monitor session 1 source interface Gi0/21 (Windows XP Desktop)
>>monitor session 1 destination interface Gi0/22 (Windows XP Laptop
>>w/Wireshark application)
>>
>>I start a capture, selecting the interface connected to the switch.
>> The
>>capture returns traffic, but all that I'm seeing is what appears to be
>>mostly ARP, Broadcast, DNS Queries and some UDP traffic (all expected).
>> What I'm not seeing is the TCP STREAMS.....I can see some TCP traffic
>>but not the entire stream....so I can't follow any of them. For
>>example, I've been trying to uncover an issue with IMAP mail clients
>>having "network disconnects" to a remote server. When I do anything in
>>my mail all I see is Echo traffic and Source = "localhost" and
>>destination is shown as the system on which my mail client resides.
>>
>>Why can't I see the traffic across the switch like I'm expecting to?
>> Do
>>I have something misconfigured. I
> haven't done this too often but I
>>though I had once before and saw all of the traffic as normal.
>>
>>Please help.
>>
>>Thanks,
>>
>>Chad Webb
>
> ------------------------------------------------------------------------
> Fussy? Opinionated? Impossible to please? Perfect. Join Yahoo!'s user
> panel
> <http://us.rd.yahoo.com/evt=48516/*http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7
>> and lay it on us.
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> http://www.wireshark.org/mailman/listinfo/wireshark-users
--
Chad S. Webb
Systems Administrator
General Dynamics Information Technology
NOAA\NESDIS\NCDDC
Bldg 1100 Rm 117
Stennis Space Center, MS 39529
Voice: 228.688.3808
Email: Chad.Webb@xxxxxxxx; chad.webb@xxxxxxxx
www.gdit.com