cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
464
Views
0
Helpful
2
Replies

SPAN not working

I have 2 SPAN sessions configured on a 6513 device. They were both previously working but they have not been operational in about a week. It stopped working the same time we removed an in-line device that we had between our Core Switch (6513) and Core Router (7606). They have a port-channel between them that had to be removed and reconnected. What I am wondering is if that is the reason SPAN is not working and it will require a reboot of the switch? The destination interface has the (monitoring) after it so it seems it is configured correctly and due to the fact I didn't change the configuration. I am just wondering if anyone has come across this sort of issue. Rebooting our 6513 requires a lot of coordination and I do not want to do this unless this is most likely the reason our SPAN stopped working. Thanks.

2 Replies 2

bd-fisher
Level 1
Level 1

I have had this occur once, and I had to remove all of the config for the span sessions, disable/enable the monitor ports, and then rebuild the span sessions.

BD, thanks for the response. I tried that just now and still the same result. The Sniffer will see packets destined for it and also multicast/broadcast but not traffic from the source interface. I am capturing in promiscuous mode which is the correct mode. It is almost like it does not see the SPAN session. Below is my switch configuration and the interfaces show down (monitoring)

monitor session 1 source interface Gi9/2

monitor session 1 destination interface Gi9/37

monitor session 2 source interface Gi9/2

monitor session 2 destination interface i12/21

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco