topic RE: Capturing FTP on mirrored port not working in Network Architecture & Design

Capturing FTP on mirrored port not working

Joe_Murphy — Thu, 24 Sep 2015 02:50:00 GMT

Hi,We have Extreme Summit x450e (48-port) switches in our environment and I'm trying to capture FTP traffic between a copier on my network and a file server.

I mirrored the copier port
Plugged a laptop into the mirrored port
Started Wireshark capture in promiscuous mode
Scanned a document on the copier which opens and FTP connection to our file server
No FTP traffic appears in the capture

OK. Let's see if I Wireshark can pick up the FTP traffic natively from my laptop, with no port mirroring

Opened Wireshark on my laptop ... capturing in promiscuous mode
established and FTP connection with the file server via CLI
Observed FTP protocol in Wireshark capture (Success!)

OK. So it's not my config of Wireshark. It is picking up FTP traffic natively from my laptop. So let's mirror the port my laptop is on and try again

I mirrored my laptop port on the swtich
Plugged a new laptop into the mirrored port
Opened Wireshark on the new laptop... capturing again in promiscuous mode
established an FTP connection from my laptop to the file server via CLI
No FTP traffic captured

This leads me to believe that there is something about the mirroring process on my switches that is not sending FTP traffic to a mirrored port. I know not everyone has Extreme switches, but has anyone heard of such behavior in their own environments?

Thanks for listening and I appreciate any help.

RE: Capturing FTP on mirrored port not working

Paul_Russo — Thu, 24 Sep 2015 04:40:00 GMT

Hello Joe

I have not seen or maybe I don't remember this ever being an issue. Can you add your mirror config to the post to see how things are set up?

In general you set up the mirror port then you add the port you want to mirror to the mirror and all traffic should show up.

I will see if I can try it out.

Thanks
P

RE: Capturing FTP on mirrored port not working

Hernandez__Josh — Thu, 24 Sep 2015 04:52:00 GMT

Hello Joe,

It would be helpful to see the mirror configuration; however, you can also double check the configuration. Typical mirror setup is as follows (utilizing the "DefaultMirror":

configure mirror defaultmirror add port (port you want to capture traffic from)
enable mirror defaultmirror to port (port you are connected to with Wireshark running)

Thanks

RE: Capturing FTP on mirrored port not working

Zdeněk_Pala — Thu, 24 Sep 2015 10:34:00 GMT

Are you sure that the printer/scanner is doing FTP?
I did not have ever issue of "not seeing traffic" with port mirroring, but can be of course bug.
When you have the mirror configured, do you see other unicast traffic from the printer?
Take another computer and ping the printer. do you see the ping & pong in your wireshark? = this will give you a hint if only FTP is missing or the mirror does not work at all...