cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2576
Views
0
Helpful
1
Replies

StealthWatch cannot show MAC address

Edward.999
Level 1
Level 1

Hi All,

 

We have installed the StealthWatch in our environment to collect traffic via both Netflow and SPAN from core switch. But it's very strange is that no MAC address shown in the console. Is there any configuration required to be modified on StealthWatch?

 

Regards,

Edward

1 Reply 1

hanjabbo
Cisco Employee
Cisco Employee

To get Mac address, there is two ways, the device has to be directly connected to the switch where the SPAN is occurring, otherwise the MAC could be of the router on that specific LAN. 

 

The more accurate way to get mac addresses is to integrate stealthwatch with Cisco ISE. 

 

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: