smunro622 Premium Member join:2006-02-15 united state |
Span portsdoes anyone know if you can do port mirroring on smoothwall, untangle, pfsense or astaro.
I have a sonicwall tz200 that cant do this and i do not want to throw a hub inline to get this traffic.
I have a linksys srw2024 but it is not really doing a good job of it... |
|
BinkVillains... knock off all that evil join:2006-05-14 Colorado |
Bink
Member
2012-Nov-28 10:48 am
Usually this is a feature of your switch
|
|
smunro622 Premium Member join:2006-02-15 united state |
smunro622
Premium Member
2012-Nov-28 10:52 am
agreed... the switch i have is doing a crappy job, i this is why i am asking here... the switch i have is a linksys srw2024 and it does port mirroring very poorly. With the holidays i dont want to spend money on a new switch right now.. |
|
BranoI hate Vogons MVM join:2002-06-25 Burlington, ON
1 recommendation |
Brano
MVM
2012-Nov-28 10:56 am
The mirroring needs to be done on HW level otherwise it will be slow and crappy. What I'm trying to say, if smoothwall, untangle, pfsense or astaro can do this it will be SW mirroring and thus slow. Managed switch is your best bet. |
|
|
to smunro622
Probably all of those firewalls include tcpdump; pfsense does for sure. However the firewall only sees the frames that arrive there, not the unicast stuff within the segment, hence the recommendation for a hub or switch. |
|
|
to smunro622
I would Highly recommend a 4 port hub to do that job @ a cheap cost. |
|
|
smunro622 Premium Member join:2006-02-15 united state |
yeah i know that is what i was trying to avoid...i have a old linksys 5 port 10/100 hub, not that that it is going to kill me cable connection so i wasnt to worried just looking for something a little bit more proper. |
|
BranoI hate Vogons MVM join:2002-06-25 Burlington, ON |
Brano
MVM
2012-Nov-28 2:04 pm
Check this other thread, we've just discussed some options for managed switches that can do this and are not expensive » Re: Rogue/faulty device eating all bandwidth. Need to find it. |
|
smunro622 Premium Member join:2006-02-15 united state |
i want to do a SG300-28 (SRW2024-K9-NA) Managed Switch it is about $600. |
|
BranoI hate Vogons MVM join:2002-06-25 Burlington, ON |
Brano
MVM
2012-Nov-28 2:13 pm
That is certainly an option that will work |
|
smunro622 Premium Member join:2006-02-15 united state |
no matter what i have tried it just wont work is th frustrating part, port 24 is setup as my source port and 23 is the target, i am doing both rx and tx. they now longer do firmware for this as i am on version 1.2.2b and the product is no longer made... |
|
BranoI hate Vogons MVM join:2002-06-25 Burlington, ON (Software) OPNsense Ubiquiti UniFi UAP-AC-PRO Ubiquiti NanoBeam M5 16
|
Brano
MVM
2012-Nov-28 4:01 pm
On switches I've seen the mirroring will stop if your connecting computer starts any transmission. So I have 2nd NIC in my monitoring PC connected to monitoring port. That NIC doesn't have any IP assigned just to be sure it does not start transmit/broadacast anything. Sniffing works great then. |
|
smunro622 Premium Member join:2006-02-15 united state |
i am moving the app from vmware workstation to a ESXI box, turning on promiscuous mode on the vswitch lets see if this makes a difference. |
|
|
to smunro622
said by smunro622:With the holidays i dont want to spend money on a new switch right now.. This for personal or for business, smunro622? Should be able to pick up a 2nd hand IOS-based 2950 24porter for less than $100USD these days, if that. Then a quick two line config change to set up a SPAN src and destination, and you're off to the races. Just my 00000010bits Regards |
|