Port mirroring; No egress packets sign on mirroring port

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Port mirroring; No egress packets sign on mirroring port

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Port mirroring; No egress packets sign on mirroring port
Port mirroring; No egress packets sign on mirroring port
2013-03-01 19:55:05
Region : UnitedKingdom

Model : TL-SG3210

Hardware Version : V1

Firmware Version : TL-SG3210_V1_121114

ISP : n/a


I'm trying to perform network diagnostics on a product under test. I’m using a series of Jetstream switches configured with port mirroring to log packets to a packet logger (Wireshark).

From factory defaults - Setting a single ‘Mirror Group’ with both Ingress and Egress mode set for mirror port X to mirroring port Y – results in only the ingress packets copied to port Y. Port X egress packets do not appear to be mirrored and are therefore not being logged.

So in the use-case where a host in sending ping requests and receiving ping responses through port X only the ICMP ping requests are sign on the logger attached to the mirroring port.

Could anyone give an insight into what I’m doing wrong or whether this is a know issue.

Many thanks,

James
  0      
  0      
#1
Options
2 Reply
Re:Port mirroring; No egress packets sign on mirroring port
2013-03-06 17:24:07
I contacted TPLink support on this issue and they advised to check the VLAN config on the logging machine. In my case the vlan was configured correctly however, an antivirus filter - enforced under global policy on our netwrok - was preventing vlan operation hence logging of the egress packets. Moving to a linux based logging solution solved the problem.

James
  0  
  0  
#2
Options
No egress packets sign on mirroring port
2014-02-25 05:33:45
Hi,

I experienced the same issue, no egress packet at all.
I am wondering did you have your issue resolved?

I use tcpdump connecting to the "mirrorring port", e.g. port 6 and the "mirrored port" is port 8, with the mirrored port enabling both "ingress" and "egress" checkbox, I am able to see the ingress packets only.
If I checked the "ingress" checbox only, packets can be seen.
If I checked the "egress" checbox only, NO packet can be seen.
Checking both will be the same as "ingress" only.

Switch is just out-of-the-box, simple setup, NO vlan, etc.

Thanks.

Michael.
  0  
  0  
#3
Options