 | 1 | initial version |
There's a couple of reasons that could be causing this behavior. Assuming you setup the SPAN correctly (your PC would be on the "monitor" or "destination" port for the SPAN Session) you should be getting packets to the NIC of the PC. One reason that you don't see packets coming in in Wireshark could be that a locally installed software drops them at an early stage (because they're not really sent to your PCs MAC). We've seen VPN software or some local firewalls do that kind of thing - so if you have any of those installed, you might want to test without them. The other thing is that if you mirror your packets with VLAN tags as part of the frames some network cards drop the packets. In that case you could try to mirror the packets without VLAN tags to see if that works.
Byt the way, usually the PC on the destination port (your capture PC) should not be able to communicate with the network anymore.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
