 | 1 | initial version |
This switch is NOT in mirrored mode.
I.e., none of the switch ports, including the port into which the PC is plugged, are set up as mirror ports?
Could wireshark somehow be telling the switch to send all packets?
Unlikely. It has no code to do so; it turns on promiscuous mode by telling libpcap/WinPcap/Npcap to open the adapter for capture in promiscuous mode, and libpcap/WinPcap/Npcap implement that by making calls that end up with the driver being told to turn promiscuous mode on for the adapter. Neither libpcap nor WinPcap nor Npcap send out any "make this a mirror port" packets, if Cisco switches even support packets of that type. I don't know of any OSes where turning on promiscuous mode causes such a packet to be sent, either, so if it's being sent, it's a result of a change to standard Wireshark, standard libpcap/WinPcap/Npcap, or standard OS code.
There shouldn't be any indication on the wire to the switch to indicate that the device is in promiscuous mode, so the most likely explanation is that, for some reason, all packets are being sent to the port(s) into which you've plugged the machines running Wireshark. Have you tried it on multiple switch ports, or just one particular port?
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
