Recommendation For A Switch With The Mirroring Port Accessible From The LAN

[PK232]

I am looking recommendations for a switch that will allow you to access the mirroring or destination port from over the LAN.

As background, I recently purchased an HP-1820 switch to supplement my HP-1800 switches. Unfortunately, much to my unhappiness, the HP-1820 does not do port mirroring the same way as the HP-1800 does.

With the HP 1800 (no longer available) you can shell into a headless Linux box hung on the destination or mirroring port and use tcpdump for monitoring the mirrored port(s). With the new HP 1820, the manufacturer “locks” or isolates the mirroring port so you cannot access it from the LAN. I am looking for a unit that does port mirroring the way the HP1800 does.

 

[brshoemak]

Can't you just buy an 1800 off eBay or is this something for business use?

 

[PK232]

As a rule I try to avoid things that could have hidden problems on Ebay, besides which realistic prices for used are few and far between. If the price were real low I might take a flyer, but without a real savings it is probably better to pay a little more and have new with the lifetime warranty that most switch manufacturers seem to be offering these days. Thanks for taking the time to reply.

 

[her209]

You are running a port mirror on the 1820, e.g., port 1 is port mirrored to port 2, and then use tcpdump on the 1820 to see the packets that have been copied to port 2?

 

[PK232]

That is correct as far as you go. In addition, I am trying to log into the Linux box on port 2 from port 3 to use tcpdump. I can do that with the 1800 but could not with the 1820.

After looking the manual for the 1810 it would appear I would not be able to do that with an 1810 either if I had one. Once you set a port to be the mirroring or monitor port on the 1810 and 1820, any access from the other ports is prevented.

 

[PK232]

@her209: Sorry for the delay in posting. I could see you were on, but I have to wait for a mod to approve my posts before you see them. Just to be sure we are on the same page, tcpdump is on the Linux box attached to port 2 and not on the 1820 as your post would seem to indicate.