Re: Query on Teamed Interfaces

[Martin Visser <martinvisser99 () gmail com>]

Charles,

I expect that it could well be that WinPcap does not operate correctly on
teamed interfaces (at least under XP). Assuming that you have tried
capturing on all of the available interfaces (as presented by Wireshark)
then you are probably going to need to use a different strategy, which is to
capture on the network. The best thing is to connect your workstation to a
managed switch that supports "span ports" or port-mirroring. Then simply
configure the switch to send a mirrored copy of your workstation,s
interfaces to another port where you have a wireshark-equipped box capturing
the traffic

Regards, Martin

MartinVisser99 () gmail com


On Sat, Oct 17, 2009 at 7:15 AM, <Charles_Johnson () discovery com> wrote:

> Nick:
>
> Thank you for getting back to me.
>
> We are running Network Fault Tolerant mode.   In a team, neither port is
> carrying the IP address,  the IP resides within the Team itself.
> We tried monitoring via the active NIC and basically had no packets
> captured.  Through the Team we are able to capture packets.
> We are filtering on Port 80 and seeing minimal amounts of traffic.   We
> were expecting alot more traffic than what we are seeing.
> The machine is an HP DL380 that has the Teaming feature.
>
>
> Charles Johnson
> Broadcast Network Engineer
> MTP&O Engineering - DCTC
> Discovery Communications
> 8045 Kennett Street
> Silver Spring, MD 20910
> Office # 240.662.4819
> Cell # 301.633.4069
>
>
>  From: <NMaio () guesswho com> To: <wireshark-users () wireshark org> Date: 10/16/2009
> 04:00 PM Subject: Re: [Wireshark-users] Query on Teamed Interfaces Sent
> by:
> wireshark-users-bounces () wireshark org
> ------------------------------
>
>
>
> Charles,
> Have you tried to just select the active interface of the team if the team
> is in an active/standby configuration?
> Nick
>
>
> *From:* wireshark-users-bounces () wireshark org [
> mailto:wireshark-users-bounces () wireshark org<wireshark-users-bounces () wireshark org>]
> *On Behalf Of *Charles_Johnson () discovery com*
> Sent:* Friday, October 16, 2009 3:53 PM*
> To:* wireshark-users () wireshark org*
> Subject:* [Wireshark-users] Query on Teamed Interfaces
>
>
> We are running Wireshark on a Windows XP machine that has teamed interfaces
> (NICs) and are not capturing packets as we have on machines with non-teamed
> interfaces (NICs)
>
> Has anyone run across an issue with teamed NICs?  Is there a workaround
> within Wireshark?
>
> Thank you!
>
> Charles Johnson
> Broadcast Network Engineer
> MTP&O Engineering - DCTC
> Discovery Communications
> 8045 Kennett Street
> Silver Spring, MD 20910
> Office # 240.662.4819
> Cell # 301.633.4069
>
>
> The storms are bigger, the teams are faster and action has never been more
> explosive.  STORM CHASERS roars back Sunday, October 18 at 10 PM (EP/PT) for
> an all-new season on Discovery Channel.  Hold on for the ride of your life!
>
>
> ***********************************************************************************************************************************************
> This e-mail, and any attachment, is intended only for the person or entity
> to which it is addressed and may contain confidential and/or privileged
> material. Any review, re-transmission, copying, dissemination or other use
> of this information by persons or entities other than the intended recipient
> is prohibited. If you received this in error, please contact the sender and
> delete the material from any computer. The contents of this message may
> contain personal views which are not the views of Discovery Communications,
> LLC.
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request () wireshark org?subject=unsubscribe<wireshark-users-request () wireshark 
> org?subject=unsubscribe>
>
>
>
>
> The storms are bigger, the teams are faster and action has never been more
> explosive.  STORM CHASERS roars back Sunday, October 18 at 10 PM (EP/PT) for
> an all-new season on Discovery Channel.  Hold on for the ride of your life!
>
>
> ***********************************************************************************************************************************************
> This e-mail, and any attachment, is intended only for the person or entity
> to which it is addressed and may contain confidential and/or privileged
> material. Any review, re-transmission, copying, dissemination or other use
> of this information by persons or entities other than the intended recipient
> is prohibited. If you received this in error, please contact the sender and
> delete the material from any computer. The contents of this message may
> contain personal views which are not the views of Discovery Communications,
> LLC.
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe