Switch SF300 - Port Mirroring

[mohammed hashim]

Hi,

I have Cisco Switch SF300-48PP

I have only one Vlan (Vlan 1) and all ports in this Vlan

 

I configured Port Mirroring, but did not work as expected, I dont see any traffic (except ARP and local Multicast).

interface gigabitethernet2
port monitor vlan 1

Packet sniffer machine is connected to GE2,

what can I do to fix this issue?

thanks,

[Georg Pauwen]

Hello,

try and use the GUI (page 89 --> Step 1 of the attached guide).

Also make sure you are running the latest firmware (1.4.9.04)...

https://www.cisco.com/c/dam/en/us/td/docs/switches/lan/csbms/sf30x_sg30x/administration_guide/78-19308-01.pdf

[Deepak Kumar]

Hi,

As per attached configuration, there is no "Type" of traffic selected in the configuration.

"Type" —Select whether incoming, outgoing, or both types of traffic are
mirrored to the analyzer port.

Regards,

Deepak Kumar

[pieterh]

"can you relate the captured data to any of the connected ports?

are there any access-lists active ?

provide more detail about the monitor config

"show monitor session all"

"suw running-config interface vlan1"

[mohammed hashim]

Thank you guys for your response,

the IOS in of this switch SF300 is mini, it is different from normal Cisco Catalyst Switches IOS

I have upgraded the firmware to the latest version

I also observed the issue is no related to the switch, because when I captured my laptop directly to the switch and run Wireshark, I got the capture correctly.

but the issue seems in the vSwitch, as the packet sniffer I have is a VM connected through vSwitch to the SPAN port.

I have made the vSwitch work as "Promiscuous Mode", but it did not solve the issue !!!

If you have faced and solved this issue before, please help me on it, otherwise I need to ask VMware community,

I apologize as this was not in the input of my first post.

[pieterh]

I don't really see why you want this setup. 

Cisco uses RSPAN that does what you describe to capture on one switch and send date to a port on another switch.

but I suggest the problem lies in VLAN "tagging" the switch span port may or may not send the packets with the original vlan tag (vlan1)!

where the vswitch port may or may not accept tagged or untagged packets.

1) try configuring the vmnic3 port as trunk to accept both tagged and untagged packets for vlan 1

2) configure the VM to not using the vswitch, but directly to another (free) vmnic