I have a Nortel switch (4524GT-PWR) which does something strange on the mirror port.
All frames that are sent to the the mirror port are tagged with VLAN 1. All frames that originate to the mirrored port do not have a VLAN tag.
To clarify this further, the PC that is connected to the mirror port is receiving frames with VLAN tags on half the packets. The original port that the traffic is mirrored from is not using VLAN tags.
ntopng
does not like this, resulting in mixed up statistics.
I have found no option in the switch to deactivate this "feature".
Is it possible to remove the VLAN tag from the frame with iptables
or something else before it reaches ntopng?
The device to capture the traffic from the monitoring port is a Realtek R8152 USB 3.0 device.