Reset Search
 

 

Article

Not able to see the egress traffic of a mirrored port when monitoring using a virtual machine

« Go Back

Information

 
TitleNot able to see the egress traffic of a mirrored port when monitoring using a virtual machine
Symptoms
Mirrored egress traffic of a port is not seen when doing a packet capture on a windows VM mounted inside a MAC OS. 
Environment
  • EXOS All
  • Summit and Blackdiamond series
  • Monitor port is connected to a virtual machine (for capturing the mirrored traffic using wireshark)
Cause
  • When the egress traffic of a port is mirrored, it generally is associated with an internal VLAN tag even though the port is untagged. This is because the mirroring mechanism happens before the VLAN translation or before VLAN ID is removed. 
  • Wireshark has a mechanism to filter this traffic and properly show them in the capture as an untagged traffic based on the register settings in the installed OS. 
  • When installed on a virtual environment such as Windows VM inside a MAC OS, the wireshark is not able to perform this filtering and hence the egress traffic is not seen in the packet capture. 
Resolution
This is not a mirroring issue. 
Use the wireshark to capture the mirrored traffic on a PC without a VM environment. 
Additional notes

Feedback

 

Was this article helpful?


   

Feedback

Please tell us how we can make this article more useful.

Characters Remaining: 255