topic StealthWatch cannot show MAC address in Security Analytics

StealthWatch cannot show MAC address

Edward.999 — Tue, 20 Aug 2019 17:47:11 GMT

Hi All,

We have installed the StealthWatch in our environment to collect traffic via both Netflow and SPAN from core switch. But it's very strange is that no MAC address shown in the console. Is there any configuration required to be modified on StealthWatch?

Regards,

Edward

Re: StealthWatch cannot show MAC address

hanjabbo — Sun, 08 Sep 2019 07:18:44 GMT

To get Mac address, there is two ways, the device has to be directly connected to the switch where the SPAN is occurring, otherwise the MAC could be of the router on that specific LAN.

The more accurate way to get mac addresses is to integrate stealthwatch with Cisco ISE.