Re: [Os-sim-support] sniffing a mirrored port

[Brian L. <br...@br...>]

Good news is, I just had to ifconfig it with "up", and now I can see the
packets that are being mirrored to that port. No crossover needed.

# ifconfig eth0 up

cienfuegos:~# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:50:8B:D9:5D:A2  
          inet6 addr: fe80::250:8bff:fed9:5da2/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500 Metric:1
          RX packets:1150 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7 errors:0 dropped:0 overruns:0 carrier:0 
	  collisions:0 txqueuelen:1000 
          RX bytes:163170 (159.3 KiB) TX bytes:510 (510.0 b)

# tcpdump -vv -i eth0

Thanks for the input. BTW, this is the box that has the PF_RING and the 
Preemptive linux real time patches. I am curious to see how it works. It
only has a 100 MB NIC though. I have one of its NICs plugged into a
Baystack 450-24T managed switch with traffic mirrored from one of the
ports to the one that is being monitored.

brian

On Fri, May 09, 2008 at 10:07:23PM +0200, Pablo R. wrote:
> Try to connect a "crossover" cable directly, without the switch and
> execute tcpdump. It doesn't need to have the 0.0.0.0 address. If it
> doesn't work, perhaps the port of the switch is broken... or the
> cable. Ensure that the promisc mode is set in the device that is
> connected as well.
> 
> 2008/5/9 Brian Lavender <br...@br...>:
> > I configured a switch so that it mirrors traffic onto a port. I
> > connected a cable from that port to an ethernet interface on a system
> > for monitoring, but I can't see anything with tcpdump. Do I need to
> > ifconfig the interface with something like 0.0.0.0? I see that when I
> > run tcpdump the interface goes into promiscuous mode, but I don't see
> > any traffic. The light on the switch is blinking too at the same rate
> > as the port it is mirroring. Any tips?
> >
> > brian
> > --
> > Brian Lavender
> > http://www.brie.com/brian/
> >
> > -------------------------------------------------------------------------
> > This SF.net email is sponsored by the 2008 JavaOne(SM) Conference
> > Don't miss this year's exciting event. There's still time to save $100.
> > Use priority code J8TL2D2.
> > http://ad.doubleclick.net/clk;198757673;13503038;p?http://java.sun.com/javaone
> > _______________________________________________
> > Os-sim-support mailing list
> > Os-...@li...
> > https://lists.sourceforge.net/lists/listinfo/os-sim-support
> >
> 
> 
> 
> -- 
> Saludos
> Pablo

-- 
Brian Lavender
http://www.brie.com/brian/