Wireshark-users: Re: [Wireshark-users] How to configure NIC that connects to Cisco SPAN port?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 10 Feb 2009 08:00:54 +0100
On Mon, Feb 09, 2009 at 06:02:30PM -0700, Stephen Fisher wrote:
> On Mon, Feb 09, 2009 at 04:26:57PM -0800, David Kraut wrote:
> 
> > Hi, I'm trying to find configuration information or examples of how to 
> > configure the NIC of a dedicated computer that will connect to a 
> > spanned/mirrored Cisco switch port.? Specifically, does the NIC need 
> > an IP address if it's connected to a span port that passes?multiple 
> > VLAN traffic?? Essentially, I want to mirror the port that everyone 
> > must go through to get to the Internet.? This traffic will be coming 
> > from many different subnets.? Any assistance would greatly 
> > appreciated!?? ?
> 
> The NIC only needs to be in promiscuous mode.  No IP address needed.

In addition to that, if you want to be able to see the vlan-tags of
every packet, you need to set up the span port so that it passes the
vlan tag, on a cisco switch you use "encapsulation replicate":

monitor session 1 source interface Gi0/49
monitor session 1 destination interface Gi0/47 encapsulation replicate

Then you need to configure your NIC driver to pass the vlan tags. By
default, most drivers strip the vlan tag. How that's done can be read
on: http://wiki.wireshark.org/CaptureSetup/VLAN

Cheers,
Sake