Page 1 of 1

Port Mirroring works ... then stops working!

Posted: 09 Feb 2012 23:56
by alcatelletacla
I have set up a port mirror on a 6850 to capture traffic from an OXE server connected to the switch. When I enable mirroring, I can see the traffic in Wireshark going to/from the OXE server on the mirrored port but after some time (anywhere from a few minutes to an hour), I don't see the traffic any more. It just stops and all I see is broadcast traffic and STP BPDUs. I know that the OXE is sending traffic because it doesn't disconnect and all the phones still work so it's not like it has stopped sending traffic!

Has anyone run into something similar? I really want to know why it stops working. Would appreciate any help!

Re: Port Mirroring works ... then stops working!

Posted: 12 Feb 2012 20:45
by alcatelletacla
It took many hours but I finally solved the problem! At first I thought the NIC was going to sleep or Windows was somehow deactivating it for power saving reasons. Disabling this still didn't solve the problem Then I thought maybe I should check the firewall and there it was! The stupid Symantec firewall was blocking all the UDP packets from the OXE server. That's why I could see STP and ARPs but no UDP. Disabled that and the flood gates opened!