For Mirrored mode, the Netscope hardware is set-up in the configuration as shown in the diagram above. NetScope uses one network port to connect directly to a mirror port on a managed switch.
The port on Netscope used is the one which corresponds to the interface name ethX in ‘Packet Capture Devices’. Usually the port marked on the outside casing with the red dot is the interface ‘eth1’.
The mirrored port should be mirroring the network traffic in both directions. Therefore to display the data Netscope needs to know which direction the traffic is flowing. When NetScope starts in mirror mode it auto-detects the router’s MAC address. Knowing this Netscope can determine the direction of the flow of network traffic, inbound and outbound.
NetScope uses a network detection algorithm to work out what is inbound and what is outbound.
(Change tabbed menu item then return back to this view to ensure the ‘Selected Gateway MAC’ value is updated)
However, there are some occasions where NetScope is unable to reliably detect your correct router. In this case you may manually enter your router’s MAC address or IP address. To do this:
- Click on the ‘NetScope’ menu item on the left-hand side, the main window will change and show your current NetScope process status.
- Click ‘next’. The ‘settings’ window will open showing the current selected MAC address.
- Uncheck ‘Autodetect Gateway MAC’.
- You may then either enter the MAC address under ‘Specify Gateway MACs’ (more than one MAC address may be entered as a comma-separated list). Alternatively, you may enter the IP address under ‘ARP on Gateway IP’ (an ARP returns the MAC address of an IP address).
- Click ‘save’.
- NetScope will now reload those settings and you should see traffic travelling in the correct direction for inbound and outbound.