I have a Linksys/Cisco wrt610n v1 router running dd-wrt. I have port mirroring enabled on my primary switch and it is mirroring the packets that I need to monitor into port 2 on my dd-wrt router. I have port 2 on the dd-wrt flashed router set up as a VLAN (vlan4) to prevent the incoming monitored data from being injected back into the network thus creating a loop. I am uncertain if this is the best way to prevent this, but it does seem to work whereas without the VLAN it would cause everything to lock up...

My issue is when I run tcpdump from the dd-wrt shell, I can't see the mirrored packets coming in. I only see broadcast packets, arp, etc. as if promiscuous mode was disabled, which ifconfig apparently says it is not.

When I connect the port I am mirroring on my primary switch to my actual computer, I can see exactly what I need to see and everything works the way it should.

Shouldn't I be able to see the mirrored packets from any device I want since I am using port mirroring to essentially make them visible to whatever device is connected?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.