blog.icewolf.ch

Let's talk about IT!
posts - 527, comments - 71, trackbacks - 0

Mirroring Port on 3Com 5500

Hallo zusammen,

Heute musste ich auf einem 3Com Switch einen Monitor Port einrichten um einen Sniffer (in diesem falle Wireshark)

Auf dem 3Com 5500G musste der Port 5 aufgezeichnet werden und an Port 16 hing der PC mit dem Sniffer.

<Core1>system
System View: return to User View with Ctrl+Z.
[Core1]interface GigabitEthernet1/0/16
[Core1-GigabitEthernet1/0/16]stp disable
[Core1-GigabitEthernet1/0/16]stp edged-port disable
[Core1-GigabitEthernet1/0/16]quit

[Core1]mirroring-group 1 local
[Core1]mirroring-group 1 mirroring-port GigabitEthernet1/0/5 both
[Core1]mirroring-group 1 monitor-port Ethernet1/0/16

[Core1]display mirroring-group all
mirroring-group 1:
    type: local
    status: active
    mirroring port:
        GigabitEthernet1/0/5  both
    monitor port: GigabitEthernet1/0/16
[Core1]

Um das Mirroring wieder aufzuheben macht man folgendes.

<Core1>system
[Core1]display mirroring-group all
mirroring-group 1:
    type: local
    status: active
    mirroring port:
        GigabitEthernet1/0/5  both
    monitor port: GigabitEthernet1/0/16
[Core1]undo mirroring-group 1
[Core1]display mirroring-group all
No mirroring group exists!
[Core1]
Grüsse
Andres

Print | posted on Monday, June 09, 2008 6:05 PM | Filed Under [ Security Network ]

Feedback

Gravatar

# re: Mirroring Port on 3Com 5500

Hello,

When the mirroring-group 1 local has made, how can you remove the group en remove the monitor port en mirroring port?

Thanks for the information to enabling roofing analysies.,

Grüsse Paul
7/4/2008 4:56 PM | Paul
Gravatar

# re: Mirroring Port on 3Com 5500

Log in with Telnet and do the following:

<Core1>system
[Core1]display mirroring-group all
mirroring-group 1:
type: local
status: active
mirroring port:
GigabitEthernet1/0/5 both
monitor port: GigabitEthernet1/0/16
[Core1]undo mirroring-group 1
[Core1]display mirroring-group all
No mirroring group exists!
[Core1]

Regards
Andres
7/7/2008 7:04 PM | Andres Bohren
Gravatar

# enable jumbo frames Port on 3Com 5500

Hello Andres,

The last time you help me great with enabling roofing analysis on 3com 5500 switch.
Thanks for that.

Now i want to enable on some port jumbo frames.
We have some performance issue with iscsi traffic to our san.

I hope you can help me out with it.

Thanks in advance

Regards Paul
12/5/2008 8:57 AM | Paul
Gravatar

# re: Mirroring Port on 3Com 5500

Hi Paul,

I think you should read this:
support.3com.com/.../...500_Family_Command_Ref.pdf

On page 180 you will find this command:
Allow jumbo frame to pass

I have found this in less than 10 Minutes - you should look at least at the documentation next time and some google searches are also recommended.

As always: RTFM - Read the fucking Manual :o)

Regards
Andres
12/8/2008 9:56 PM | admin
Gravatar

# re: Mirroring Port on 3Com 5500

Hello,

another way is to directly put the "mirroring-port" and "monitor-port" commands on the corresponding interface, the switch will automatically put them in the mirroring-group.

So just use this:
[Core1]interface GigabitEthernet1/0/16
[Core1-GigabitEthernet1/0/16]stp disable
[Core1-GigabitEthernet1/0/16]stp edged-port disable
[Core1-GigabitEthernet1/0/16]monitor-port
[Core1-GigabitEthernet1/0/16]quit

[Core1]interface GigabitEthernet1/0/5
[Core1-GigabitEthernet1/0/5]mirroring-port both
[Core1-GigabitEthernet1/0/5]quit

And you'll have the same result :-)

Bien à vous
Guillaume
4/29/2010 2:13 PM | gcharreyron

Post Comment

Title  
Name  
Email
Url
Comment   
Please add 7 and 3 and type the answer here:

Powered by:
Powered By Subtext Powered By ASP.NET