Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

port mirror for wireshark

Status
Not open for further replies.

carljong2015

IS-IT--Management
Sep 29, 2016
3
US
I'm trying to mirror the port on our 3300 MXe III so I can run a Wireshark capture. I've done this before, but it is not working now. I connected via a raw session to port 2002 and entered xmirror "2 1" command. The interface says the mirroring is in place, however, I seem to recall the lines on the second port were lit, even without a PC connected to it. Now they are all dark. I run the icpL2StatShow 2 command and the port status says "Down". How do I change it to "Up"? Is there another port I could use? Any help or suggestions would be appreciated. Thanks.
 
Have you set an IP address for "Layer 2 (L2) Switch IP Address" in the System IP Properties from?
 
Are you aware that the 3300 can run the wireshark natively and store on the harddrive?

**********************************************
What's most important is that you realise ... There is no spoon.
 
The Layer 2 (L2) Switch IP Address is set.

I saw that the 3300 can run the wireshark natively and store on the harddrive, but, if I understood it correctly was it only one call for one phone at a time?

I have three users who have issues with their phones. They do not have the problems on every call. What I was hoping to do was to run a capture for the whole office while they are working. Then, if they do have a problem, I'll have the details.

In the meantime, I did see that you can mirror the port on the phone ( That let's me get the detail by phone, but ultimately, I'd rather get it off the 3300.
 
The TCPDump will capture all ethernet traffic on the controller, there's no way to segregate out one phone/trunk/whatever. That would be easier than messing around with the port mirroring.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top