Procurve 4000m How to configure port for sniffing? 1

[pkirill]

We've just installed a monitoring/filter solution that requires "mirrored" ports. Can anyone describe to me how to configure a procurve 4000m port so it will "see" all the traffic on the network?

Currently I have one port configured as a "monitored" port - this goes to the server running the filter software. I have another port "monitored" and this goes to the firewall. From the limited documentation, this seems to be the correct way to do it. Can anyone confirm?

Thanks for any help!

 

[polymath5]

I don't think you are supposed to have 2 monitored ports. Something about that doesn't sound right.

=============
Mens et Manus
=============

 

[pkirill]

Most excellent! I had put this off for a while while researching the answer. That simple little fix was staring me in the face... I had probably tried that at one point, but didn't wait long enough for the software to begin reporting...

That was the answer - so thanks!

 

[polymath5]

Glad I could help!

=============
Mens et Manus
=============

 

[JBruyet]

FWIW, you can monitor as many ports on the switch as you want. I have my 4000M monitor port setup to see everything that goes through my switch, and I use Colasoft software to look at what's going on. I've discovered and shut down a couple of Gnutella servers that were running on my network by monitoring everything.

HTH,

Joe Brouillette

 

[polymath5]

Yes, you can monitor all the ports to see all the traffic, but only one port is going to be the 'reporting' port.

=============
Mens et Manus
=============