First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Unable to receive the unicast traffic from others

OS : Win10 NIC : Intel ethernet 10G 2P X520 Switch : Cisco 2950 Link speed : 1G

My server is directly connected to the mirror port of the switch. I'm only able to receive the broadcast/multicast traffic inside the network, but unicast from others is not seen at all. (MonitorMode or MonitorModeEnabled = 1 registry setting is also done) Of couse I tried to use other onboard NIC but it worked very fine. Is there any possible reason for this?

Any comments will be helpful.

SDKIM's avatar
1
SDKIM
asked 2019-06-26 06:45:47 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

I can think of two reasons you are only seeing broadcasts and multicasts:

  1. There is no monitor session defined on the switch (or maybe it is not configured properly)
  2. The Intel NIC was not put into promiscuous mode, did you select promiscuous mode in Wireshark when you started the capture?
SYN-bit's avatar
18.5k
SYN-bit
answered 2019-06-26 10:14:48 +0000
edit flag offensive 0 remove flag delete link
more

Comments

Thanks for your reply. As I mentioned, other NIC is working fine as I expected. This means there is no issue on the switch config. And wireshark's Promiscuous mode is also on. NiC seemed to discard the unicast traffic..don't know why..

SDKIM's avatar SDKIM (2019-06-26 10:29:45 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer