Comware

The core of our LAN is a pair of stacked 2650 switches. One port ( port 48) on one switch is connected to a NetGear WAN router, and thus to the internet. Thus all internet traffic goes through this port.

I have installed WebSense software on one of the LAN machines to monitor internet usage.

Websense requires that all traffic on the port connected to the internet (48) be mirrored to this PC's port ( in this case 47).
Via the switch web interface I set the monitor port to be 47, and selected the port 48 to mirror. Confirmed through " show monitor" in the CLI.
Yet the PC ( port 47) does not appear to get any outgoing traffic on port 48.

Are there any problems with mirroring??
I am on switch software version 07.32.

Hi Andrew,

You mention "Yet the PC ( port 47) does not appear to get any outgoing traffic on port 48" I am afraid that is correct as te 2650 (like the 41XX) will only monitor Ingress Traffic (Incoming). This is a hardware constraint. Sorry to say so.

Thanks, Ardon

Hi ardon,
Is it possible to achieve with 2-way port spanning?


Andrew

Andrew,

There is a workaround. I have attached a document that describes how to configure.
A very easy one would be, as you are using an 100 speed port, to insert a Hub inline on that link running to your ISP and connect the Sniffer PC to that hub.

How to configure the 2650, using a Monitoring port, and still see Ingress and Egress traffic on the link, is described in the attached .doc file.

Hope this helps.

Thanks for the word doc - As you point out the 100BT hub solution is easy and cheap - seems to wotk well.

Thanks again!

Ardon:

When I try downloading your attached doc, I receive zero characters. Is there another source for this info?

TIA,
Evan

Hi,

With firmware G.07.50 we changed the way we Monitor. Now we Monitor both Ingress and Egress so no need for the former work-around.

Ardon

?

Thanks for the info, I will download 0.7.50 and try it out.

Guys,

I made a huge mistake. The enhancement I mentioned to monitor both Ingress and Egress applies to the I.07.51 code (28XX).
I am very sorry for the inconvenience.

Ardon

So it does not apply to the 2650?

It seems it does not, since 26xx and 41xx have a HARDWARE limitation that allows only ingress traffic to be directed to the monitoring port.

I have a 2626PWR that has ingress/egress port monitoring. I installed a software update 3 years ago and it now works.