NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Solved
Port Mirroring Disables Network Access on Probe
My goal is to set up a network monitoring device on port g3 (probe port). Port g1 is my uplink to the router/DHCP server. I installed a laptop on port g3 and everything is fine in normal switching mode. DHCP, DNS, HTTP, Pings, etc.
When I enable the "Session Mode" on port g1 to mirror (TX and RX) to port g3 I can see all the packets for the other attached devices on the network while I am sniffing on port g3. This is what I wanted to do. But I can no longer access the network. All the aforementioned services fail. Disabling the Session Mode disables the mirror and my network access returns to normal switched access.
Is this behavior intended? When a device is on the probe port of a mirrored port, is network access supposed to be disabled for the probe? Is this officially documented anywhere? Nothing in the help files or administration guide mention this behavior. I am running the latest firmware available today Software Version: 5.4.2.33
Thank you for any assistance.
--j
Absolutely industry standard. A mirror port does only give you access to the mirrored data for promiscuous mode sniffing, recording, whatever. No way to distinguish between miror data and communication otherwise...
2 Replies
Absolutely industry standard. A mirror port does only give you access to the mirrored data for promiscuous mode sniffing, recording, whatever. No way to distinguish between miror data and communication otherwise...
Awesome! Thank you for the quick response. I haven't had much experience with mirroring. I appreciate your help.
NETGEAR Academy
Boost your skills with the Netgear Academy - Get trained, certified and stay ahead with the latest Netgear technology!
Join Us!
