We had a request from Core network department about packet capture on NE80E router ports connected to one core equipment that belongs to another vendor .configuration on ports were layer 2 and the requirement was capturing all inbound and outbound packets to realize this equipment functions. we used Ethereal software and layer 3 port mirroring but it was not successfull,so we used same Layer 2 vlan on both mirroring port and observing port.
1.There was no information about function of this core device,because it belongs to another vendor ,so we just had a range of ip addresses assigned before in IP plan .
2.we checked NE80E configuration,there were two different vlans assigned to this kind of equipment(vlan 130 for signaling and vlan 100 for NMS) and Vlan130 was binded to Signaling VPN,so the interface vlan configured with an ip addess and the configuration on interface GE was:
port link-type trunk
port trunk allow-pass vlan 100 130
stp point-to-point force-true
3.we configured observing and mirroring port like this :
[NE80E]observe-port 1 interface gigabitethernet 3/0/23(free port)
[NE80E-gigabitethernet3/0/1]port-mirroring to observe-port 1 inbound out.
4. we did not assign any ip address to laptop Network card and then we run Ethereal but we did not recieve any packet from NE80E observing port.
5. we changed our solution and changed our observing port to other free port and set ip address in different range like huawei documents but it did not work again.
6. we did layer 2 configuration on observing port:
port default vlan 130
it is important to use same vlan as mirroring-port on observing-port
but there was no ip address in laptop network card,then we recieved all needed packets after running Ethereal.
Because mirroring port was member of vlan,so if at observing port we used ip and layer3 ,packets could not be catched.