05-02-2007 12:24 PM - edited 03-05-2019 03:49 PM
In Cisco IOS on a switch you can do a 'monitor session.....'. There are options for spanning and monitoring a port's traffic or the traffic from a VLAN. Obviously the main difference is that one allows the ability to see all VLAN traffic for a particular VLAN but what are the other differences?
When I tried this before with a Sniffer application, I specified a source and destination. I tried it by spanning the vlan and by port and I got different information. What is the difference?
Any URL links would be appreciated.
Solved! Go to Solution.
05-02-2007 02:02 PM
Michael,
When you SPAN a VLAN you are selecting all of the ports assigned to that VLAN. A show monitor session for a VLAN SPAN will list the actual source ports in that VLAN. So you could SPAN the same traffic by entering the list of ports, it's just a lot easier to specify the VLAN.
When you SPAN a VLAN you will often capture the same packets twice, since they are received on one port and transmitted on another port you are SPANing. By selecting RX only you can avoid this. On older IOS RX was the only choice for VLANs, but with newer code Both is the default.
Please rate helpful posts.
Dave
05-02-2007 02:02 PM
Michael,
When you SPAN a VLAN you are selecting all of the ports assigned to that VLAN. A show monitor session for a VLAN SPAN will list the actual source ports in that VLAN. So you could SPAN the same traffic by entering the list of ports, it's just a lot easier to specify the VLAN.
When you SPAN a VLAN you will often capture the same packets twice, since they are received on one port and transmitted on another port you are SPANing. By selecting RX only you can avoid this. On older IOS RX was the only choice for VLANs, but with newer code Both is the default.
Please rate helpful posts.
Dave
05-02-2007 02:14 PM
Some SPAN Terminology...
Source (SPAN) port ?A port that is monitored with use of the SPAN feature.
Source (SPAN) VLAN ?A VLAN whose traffic is monitored with use of the SPAN feature.
Destination (SPAN) port ?A port that monitors source ports, usually where a network analyzer is connected.
Reflector Port ?A port that copies packets onto an RSPAN VLAN.
Monitor port?A monitor port is also a destination SPAN port in Catalyst 2900XL/3500XL/2950 terminology.
A particular SPAN session can either monitor VLANs or monitor individual interfaces?you cannot have a SPAN session that monitors both specific interfaces and specific VLANs.
If you will, read the following link which
should explain fairly well. If you have more questions, please post away.
http://www.cisco.com/warp/public/473/41.html
HTH for now
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: