Comware

Hello,

I have a cluster made of 3 4800g pwr switches. They have, mos of all, defalut security configuratyions, however recently I connected my laptop on a ramdom port and wireshark is catching all traffic on s,witch. Looks like all ports are mirrored to all ports.

Is it possible to disable this?

Thank you,

Cláudio Soares

P.S. This thread has been moved from Switches, Hubs, Modems (Legacy ITRC forum) to Comware-Based. - Hp Forum Moderator

Hi,

try to reduce the scope of your test/troubleshooting.

E.g.:

* use wireshark on your laptop, next ping from 1 host to some other host. Do you see the ping ?

This will tell you if all packets are flooded or just some packets.

Verify these mac-addresses with "dis mac-address" on the switch.

* For the packets which you do see in the wireshard, take the destination address and lookup on the switch with "dis mac-address".

* Check these mac-addresses on your PC arp table (arp -a), you may need to perform a ping to the host IP first.

* do you find any missing matches between switch mac-tables and local pc arp tables ?

Do you have microsoft NLB clusters in the network ? The will use a multicast or unknown unicast mac-addrses for their ARP reply, which forces the switch to flood traffic.

Good luck,

Best regards,Peter.