This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

PRTG only works correctly when wireshark is capturing snmp packets

0

Hi guys, i have the curious problem that my PRTG snmp sensors does only work with a running wireshark capturing session. Can you tell me what the problem can be or how i can solve it.

asked 10 Sep '14, 04:31

burge's gravatar image

burge
11112
accept rate: 0%


One Answer:

0

Check the MAC addresses of the SNMP packets. They are most likely not having the destination MAC of the system you want them to be received on, which is why the NIC of that system discards them (unless Wireshark is running, which means the card accepts any frame).

answered 10 Sep '14, 05:11

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

You are right. I have a 4 port bond0 configured and sometimes Packets with the mac of a member comes in. How do i implement that the packets always have the mac of the bonding interface as destination?

(10 Sep '14, 05:32) burge

good question - you'll have to figure out why the sender got the wrong MAC in the first place. I guess there are ARP requests for the IP of the target system that sometimes carry the wrong MAC. You need determine why that happens; I guess some kind of misconfiguration is involved.

Does the switch where the bond members connect to also know that those links are supposed to be treated as a bonded channel? Otherwise you'll get into different kinds of trouble all the time.

(10 Sep '14, 05:43) Jasper ♦♦

Yes. Bonding is already configured on the switch

(10 Sep '14, 05:58) burge

Hint: please use comments instead of answers if you have to add something ;-)

If bonding is fine, you need to capture traffic at one of the sources for the SNMP packets to see what kind of ARP replies they get when looking for the SNMP destination, and which system sends them. Usually, ARP replies come from the destination MAC, so if you see that the bounded NICs respond with bad values you may have a problem with the bond software.

(10 Sep '14, 06:01) Jasper ♦♦