MSG timeout - wireshark shows constant retransmissions

ASF said:

...Using the web interface for the switch, I don't know of any way to set a port up to mirror two ports at once. I don't think it's possible...

Click to expand...

robertkjonesjr said:

From the Stratix user manual:

Quote:
You can configure port mirroring on only one port via Device Manager.
However, you can configure multiple ports via the CLI.

Click to expand...

970047 - Multiple Port Mirroring Sessions on a Stratix switch
Access Level: TechConnect

(Workaround 2)

Yes, for the Stratix switches, which are essentially Cisco IOS, this is quite possible via the CLI.

G.

robertkjonesjr said:

I don't know the Stratix series, but I do know the usual Cisco IOS platforms, as well as others and this is actually a common issue - having two source ports set to a single destination like this. From the Stratix user manual:
You can configure port mirroring on only one port via Device Manager.
However, you can configure multiple ports via the CLI.

Click to expand...

Quite correct, and George's technote backs this up. I was doing this via the web interface though, so it *shouldn't* have been possible? Based on what I've seen so far, and the face that it is possible to mirror from two ports at once, I'm inclined to think that that's exactly what happened, and that there is a bug involved that allowed me to do it from the web interface despite it "not being possible". Quite possibly related, as I mentioned previously, to me not unplugging from the mirroring port between settings.

robertkjonesjr said:

For general capture use, I started buying these for my team:

https://www.tp-link.com/us/products/details/cat-5711_TL-SG105E.html

You can set a mirror port so acts just like a tap; and on Amazon, it's less than $30US. But it needs a power supply / wall wart. Some of those other ones are USB powered, so can run off a laptop which can surely be convenient sometimes.

For serious use, if I can't get a span port out of the infrastructure, I had to stop using the FTE device. I found this to be far superior and very easy to use:

https://www.profitap.com/profishark-1g/

But it is in the professional category - it's like $3000 or so.

Click to expand...

Whoa, that does look good but I'm sure as hell not selling that one to my boss!


This one, maybe. Based on your experience, would you say it should be a good bet?

ASF said:

This one, maybe. Based on your experience, would you say it should be a good bet?

Click to expand...

I own the 100MB version of that sharktap. I think I paid $69 at the time, it's pretty awesome.