Wireshark Captures and port Mirroring

Hello

I am trying to get capture of traffic on cisco switch port.
I use a monitor session to do it and wireshark
Unfortunatly, wireshark just give computer packets,not switch packets.

How can i get siwth packet on my wireshark capture ?

Thanks

 

Sounds like you haven't properly setup a monitor session on the switch.
Otherwise, sounds like you are doing what you need to do, you should
see the results of all the traffic you are requesting a port mirror of
inside Wireshark.

 

Hello Doug,

For example, the computer i want to monitor is on fa0/1. Computer where
Wireshark is is on fa0/2

I Just configure : monitor session 1 source int fa0/1
and then monitor session 1 dest int fa0/2

On Wireshak, I have the trafic that comes from the computer linked on fa0/1
but not the trafic from the switch to the computer linked on fa0/1

Thanks for help

 

My instant take on this is that the problem is that you
are specifying "dest". This is *not* where to mirror the
traffic to. It is saying that you only want to see traffic
with the destination out of the port. Or maybe it is the other
way round - I am sure you can work it out.

If you just miss out the dest, I guess it will all spring to life.
Or may be you need to use "source dest"?

Post "sh monitor", or equivalent on your platform, for
further advice. ("show span"?).

 

Sorrry, ignore above nonsense.

Post sh monitor, though please.

 

bod43 wrote:
Post sh monitor, though please.

I Will as soon as i'll be at work... only 1 am here...

But i think i have just not used the right method for catalyst 35xx series..

I used conf t
monitor session 1 source int fa xx/xx
monitor session 1 dest int fa xx/xx

And I just saw in cisco doc that I rather use
conf t
int faxx/xx (dest)
port monitor fastethernet xx/00

Will try it

TY for advices

 

Sh mon :

Session 1
---------
Type : Local Session
Source Ports :
Both : Fa0/26
Destination Ports : Fa0/3
Encapsulation : Native
Ingress : Disabled

Commands i plan tu use are not the one for my switch (Cisco 3560 48ps)...

Will search again...

 

Here below is _working_ config:

TY Will try as soon as possible.

Yet I thought that monitoring session permit to catch all trafic, with or
without vlan...