LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 03-06-2014, 09:09 AM   #1
marcusone
LQ Newbie
 
Registered: Jun 2008
Posts: 5

Rep: Reputation: 0
Network monitor (via mirrored port to dedicated e1000)


I have my switch setup to send all packets tx and rx from my internet connection port to a mirrored port.

I can monitor that port in windows with wireshark and all looks good.

When I move it to a linux machine to use fprobe; it only sees 'rx' packets. No 'tx'!

I have set to promiscuous mode (ifconfig eth1 promisc)
using tcpdump -ni eth1 shows the same issue, only one way packets.

ifconfig shows the rx packets climbing (incrementing) like crazy with no change in tx packets

Any ideas?
 
Old 03-09-2014, 07:16 PM   #2
Ser Olmy
Senior Member
 
Registered: Jan 2012
Distribution: Slackware
Posts: 3,340

Rep: Reputation: Disabled
Well, of course if does... the mirror port on the switch sends a copy of all traffic (inbound or outbound) on the port being monitored to eth1 on your server. Every packet gets registered as incoming on eth1, and the RX counter gets incremented.

The TX counter on eth1 only counts outbound packets generated by the system, and surely that would make no sense for a NIC connected to a mirror port on a switch?

(You should however put the interface in promiscuous mode, as it needs to process packets with any destination MAC address.)
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to monitor network traffic on a specific port with Zabbix? LocLuu2008 Linux - Server 0 10-22-2011 05:49 AM
One dedicated vlan port and one tagged port, share IP? jeriryan Linux - Networking 2 02-11-2011 06:24 PM
DMA Transfer from Network Interface to Memory? Intel e1000 nematoad Linux - Hardware 3 12-27-2008 04:15 PM
setting up com port for serial connection to monitor network switch help murf562 Linux - Hardware 1 10-30-2004 09:46 AM
Howto monitor network trafic on specific port MDanger Linux - Networking 2 03-31-2004 01:45 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 03:27 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration