Start a Conversation

Unsolved

M

5 Posts

1992

March 3rd, 2019 09:00

Dell N1548 Port mirroring issue

We have a Dell N1548 with latest firmware. We have an issue where we are mirroring the uplink port #47 to our router to destination monitor port #39.

So we should be able to see all traffic TX/RX from the local lan outside to the WAN. However we are only see the RX traffic coming in on port 47.

The ONLY TX traffic we capture is traffic from the MGMT interface of the Dell going out; either to the remote user browsing the Dell Web gui, pinging the mgmt interface or the Dell switch hitting the remote NTP server.

I have verified this with wireshark.

Here is the config info with ONLY trying to mirror TX traffic. (I cut out all the other interfaces as they are literally all the same:

!Current Configuration:
!Software Capability "Stack Limit = 4, VLAN Limit = 512"
!Image File "N1500v6.5.3.4"
!System Description "Dell EMC Networking N1548, 6.5.3.4, Linux 3.6.5, Not Available"
!System Software Version 6.5.3.4
!
configure
snmp-server location "Server Room"
snmp-server contact "ME@me.com"
hostname "Switch1"
slot 1/0 2    ! Dell EMC Networking N1548
sntp unicast client enable
sntp server 172.16.10.12
clock timezone -7 minutes 0
stack
member 1 3    ! N1548
exit
interface vlan 1
ip address 172.16.182.7 255.255.255.0
exit
ip default-gateway 172.16.182.1
username "" password  privilege 15 encrypted
application install SupportAssist auto-restart start-on-boot
!

interface Gi1/0/39
description "ESX1-3"
exit
!
interface Gi1/0/47
description "Router_TRUST"
exit
!
exit
monitor session 1 destination interface Gi1/0/39
monitor session 1 source interface Gi1/0/47 Tx
monitor session 1 mode
snmp-server engineid local 800002a203e4f004bd77cc
eula-consent hiveagent reject
exit

The destination port is an ESX port that is set to promiscuos mode. We tested mirroring other ports to 39 and was able to capture local LAN TX/RX traffic.

We have anothe N1548 in another office where we tested mirroring an uplink port (but not to a router [Juniper SRX220] and was able to capture TX/RX traffic.

We have other offices with similar setup, albeit with Cisco switches doing the switching, Juniper SRX, and monitoring VMs on ESX setup in promiscous mode and have no issues.

Showing counters:

Switch1#show interfaces counters gigabitethernet 1/0/39

  Port      InTotalPkts      InUcastPkts      InMcastPkts      InBcastPkts
--------- ---------------- ---------------- ---------------- ----------------
Gi1/0/39               837                8               20              809

  Port      OutTotalPkts     OutUcastPkts     OutMcastPkts     OutBcastPkts
--------- ---------------- ---------------- ---------------- ----------------
Gi1/0/39           8158440          8154821              970             2649

FCS Errors: ................................... 0
Single Collision Frames: ...................... 0
Late Collisions: .............................. 0
Excessive Collisions: ......................... 0
Multiple Collisions: .......................... 0
Received packets dropped > MTU: ............... 0
Transmitted oversized packets: ................ 3922
Internal MAC Rx Errors: ....................... 0
Received Pause Frames: ........................ 0
Transmitted Pause Frames: ..................... 0
Receive Packets Discarded: .................... 34
Transmit Packets Discarded: ................... 0
Switch1#show interfaces counters gigabitethernet 1/0/47

  Port      InTotalPkts      InUcastPkts      InMcastPkts      InBcastPkts
--------- ---------------- ---------------- ---------------- ----------------
Gi1/0/47           5357314          5355492              968              854

  Port      OutTotalPkts     OutUcastPkts     OutMcastPkts     OutBcastPkts
--------- ---------------- ---------------- ---------------- ----------------
Gi1/0/47           8113227          8110106              677             2444

FCS Errors: ................................... 0
Single Collision Frames: ...................... 0
Late Collisions: .............................. 0
Excessive Collisions: ......................... 0
Multiple Collisions: .......................... 0
Received packets dropped > MTU: ............... 0
Transmitted oversized packets: ................ 0
Internal MAC Rx Errors: ....................... 0
Received Pause Frames: ........................ 0
Transmitted Pause Frames: ..................... 0
Receive Packets Discarded: .................... 0
Transmit Packets Discarded: ................... 0

Not sure what i'm missing here...should be straight fwd.

Moderator

 • 

8.7K Posts

March 5th, 2019 09:00

Can you private message me the service tag?

No Events found!

Top