Portable 4.8

[cgonan]

Another newbie.

I just installed the demo portable 4.8 version, on a machine with 2 network cards. I have an environment of Cisco switches. The docs say that this version does not require a mirrored port and traffic can be captureed from an entire vlan on that port. Do I have to setup a SPAN port on the switch? If so, what is the source port?

When I installed the software, I was first prompted for a card, so I chose the on-board interface. It did not say that this was the Transport or Monitor card.

I also do not have snmp enabled on the switch that these network cards are patched into. Does this have to be done?

I am seeing traffic, but only the expected broadcast and multicast traffic.

Any clues to get this working?
Thanks

 

[jdeisenm]

I wrote some helpfull stuff and put it in and FAQ. Check it out.

Transport is the card used to ping/telent and to management functions. Monitor is the card you capture on. They can be the same card and you can do both at the same time. It just depends on your application. Remote sniffer (sniffer distributed) or a sniffer portable running VNC should have 2 nic's with one dedicated to each task.

You don't need SNMP on the switch. You do need to configure it though!

That said, I presume you are the owner of the cisco switch and have console access. Run the command listed in the faq (if you have IOS on your switch. If not, look in the cisco forum.

Once you have your switch configured. Plug your sniffer monitor port into the switch port you defined as the monitor destination.

 

[netwho]

The term transport/monitor cards referres more towards the Sniffer Distributed products.

On portable you might use a 2nd card to issue the span commands to the switch - see monitor -> switch monitor.
This requiers SNMP ....

If you don't use SNMP, you can telnet to the switch and go into enable/configuration mode end enter the following command (in case of an IOS based switch):

Switch(config)# interface FastEthernet0/7
Switch(config)# port monitor FastEthernet0/3

You will in this example attach you "sniffer card" on port 0/7 and capture traffic from port 0/3.

This can be verified by:

Switch# show port monitor
Monitor Port Port Being Monitored
--------------- --------------------
FastEthernet0/7 FastEthernet0/3

Rgds, netwho


__________________________________
DOS -> Windows -> Linux -> FreeBSD
**** The evolution of a geek ****