Connecting Monitoring tool (wireshark, gigamon) to switch appears to be up and down (amber link)??

[ohforce55]

Hi,

I noticed that the links that are connecting from switch to gigamon or wireshark became up and down, and it appeared to be amber.

I heard that it is because there is no any protocol going on from wireshark or gigamon.

Can you please explain in more detail?

Thank you!

[Julio E. Moisa · Accepted solution]

Hi

Usually when you are connecting a device running Wireshark to a switch, the switchport should not has any configuration, it should be configured as default and the Computer/Server/s NIC as well, no configuration.

You could see the interface up down. The Span port will send the information to that port as destination. 

Most of the time the computers or servers have 2 NICs, one of them without any IP address and the other one for management with IP address. 

[ohforce55]

Thank you for the reply!

Last time I saw a switch connecting to a F5 box and it had no any configuration as well.

But it was up up.

Can you please explain about that?

Thanks!

[Mark Malone]

switchport and f5 port on same vlan 1 by default would bring it uip/up without any config , vlan 1 doesnt need to be specified as its default thus requiring no config , could be one way that it worked

[ohforce55]

Thank you so much for your comment.

To be honest, I'm not quite quite on your first comment.

"The Span port will send the information to that port as destination. Most of the time the computers or servers have 2 NICs, one of them without any IP address and the other one for management with IP address."

And if there is no any config for wireshark like F5, then wouldn't it be used as vlan 1 by default so it is up up?

Sorry for another questions. :(

[Julio E. Moisa]

Hi

I have not used F5 before, but in normal SPAN situation you leave the switchport without configuration (destination port)

[ohforce55]

Hi Julio,

I got that but still can't understand why it is up and down... T.T

Sorry. I will very appreciate if you can explain in more detail for me.

Thank you!

[Mark Malone]

Is the port that's down the monitoring port ?

[ohforce55]

The port on the switch (which is being monitored) is up and down.

Can you please explain why?

Is it because wireshark doesn't use any protocol??

[Mark Malone · Accepted solution]

Its because you have set it as a destination port , that's how the feature works , its sets the port into that state once its part of the destination config , span monitoring port

from the doc

SPAN Destination Port Up/Down

When ports are spanned for monitoring, the port state shows as UP/DOWN.

When you configure a SPAN session to monitor the port, the destination interface shows the state down (monitoring), by design. The interface shows the port in this state in order to make it evident that the port is currently not usable as a production port. The port as up/down monitoring is normal.

[ohforce55]

Thank you so much!!!