This is what I get from "dmesg | grep promisc" & "ifconfig -a" eth0 is the
one currently plugged into a hub with the target but it is also the
interface I have used plugged into the FE 0/8 that is monitoring FE 0/3
<SNIP>
!
interface FastEthernet0/3
switchport trunk encapsulation dot1q
switchport trunk native vlan 11
switchport mode trunk
switchport voice vlan 111
!
<SNIP>
!
interface FastEthernet0/8
port monitor FastEthernet0/3
!
<SNIP>
Las_Cruces3524_1#sh port monitor
Monitor Port Port Being Monitored
--------------------- ---------------------
FastEthernet0/8 FastEthernet0/3
<SNIP>
[EMAIL PROTECTED] spike]$ dmesg | grep promisc
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
eth0: Setting promiscuous mode.
eth0: Setting promiscuous mode.
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
eth0: Setting promiscuous mode.
eth0: Setting promiscuous mode.
eth0: Setting promiscuous mode.
eth0: Setting promiscuous mode.
device eth0 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
device eth1 entered promiscuous mode
device eth1 left promiscuous mode
eth0: Setting promiscuous mode.
device eth0 entered promiscuous mode
device eth0 left promiscuous mode
[EMAIL PROTECTED] spike]$ /sbin/ifconfig -a
cipsec0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
BROADCAST MULTICAST MTU:1400 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
eth0 Link encap:Ethernet HWaddr 00:08:74:
inet addr:192.168.11.73 Bcast:192.168.11.255
Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:576557 errors:0 dropped:0 overruns:0 frame:0
TX packets:49 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:43357674 (41.3 Mb) TX bytes:7734 (7.5 Kb)
Interrupt:11 Base address:0xec80
eth1 Link encap:Ethernet HWaddr 00:40:05:
inet addr:192.168.11.81 Bcast:192.168.11.255
Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:333129 errors:0 dropped:0 overruns:0 frame:0
TX packets:124925 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:31761378 (30.2 Mb) TX bytes:12228323 (11.6 Mb)
Interrupt:11 Base address:0xb000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:565755 errors:0 dropped:0 overruns:0 frame:0
TX packets:565755 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:38652246 (36.8 Mb) TX bytes:38652246 (36.8 Mb)
[EMAIL PROTECTED] spike]$ /sbin/ifconfig eth0 -promisc
SIOCSIFFLAGS: Permission denied
[EMAIL PROTECTED] spike]$ su
Password:
[EMAIL PROTECTED] spike]# /sbin/ifconfig eth0 promisc
[EMAIL PROTECTED] spike]# /sbin/ifconfig eth1 promisc
[EMAIL PROTECTED] spike]# /sbin/ifconfig -a
cipsec0 Link encap:Ethernet HWaddr 00:00:00:00:00:00
BROADCAST MULTICAST MTU:1400 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
eth0 Link encap:Ethernet HWaddr 00:08:74:
inet addr:192.168.11.73 Bcast:192.168.11.255
Mask:255.255.255.0
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:577043 errors:0 dropped:0 overruns:0 frame:0
TX packets:49 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:43394448 (41.3 Mb) TX bytes:7734 (7.5 Kb)
Interrupt:11 Base address:0xec80
--
Mike
-----Original Message-----
From: McNutt, Justin M. [mailto:[EMAIL PROTECTED]
Sent: Thursday, September 11, 2003 9:53 AM
To: [EMAIL PROTECTED]
Subject: RE: [Ethereal-users] mirrored/monitored/SPAN'd port not working
Do a 'dmesg | grep promisc' and make sure the interface is actually going
into promiscuous mode. Also check the output of 'ifconfig -a'. You should
see confirmation there as well.
But I'll bet that the problem is that the port mirror is not set up
correctly, or that the port mirror is not working. There have been several
versions of code in which port mirrors act strangely...
--J
-----Original Message-----
From: Mike Kelley [mailto:[EMAIL PROTECTED]
Sent: Wednesday, September 10, 2003 4:41 PM
To: '[EMAIL PROTECTED]'
Subject: [Ethereal-users] mirrored/monitored/SPAN'd port not working
I've spent over 8 hours researching and trying and RTFM'ing ... I had my
network admin mirror a port on our cisco switch. When I sniff the port all I
get is the broadcast messages or local traffic
I have read
http://www.ethereal.com/faq.html#q5.1
over and over ... I have manually (ifconfig ...) put the interfaces into
promiscuous mode.
What next to trouble shoot?
Thanks in advance
Mike
