SPAN session on CAT 2950

Unanswered Question
Aug 6th, 2007
User Badges:

I have a question about setting up a SPAN session:


We have a banking ATM that needs to have all transaction data superimposed on the DVM monitoring images.


Accroding to the ATM people:


"The DVR device needs to be deployed onto a mirror port of the ATM. In this manner as the ATM transaction is mirrored onto the DVR port the message stream can be parsed for the transaction data so that it may be superimposed onto the DVR image."


My understanding of this is that it would be a simple monitor session configured to monitor the ATM port and mirror it onto the destination port, which is where the DVM equipment will be plugged into the switch.


If that is that case, can I still communicate with the DVM equipment if it is plugged into a mirror port?


Is the session destination port still active on the network like any other port, just has the data from both ports on it?


The link to the router is trunking two vlans on the switch, not sure if that makes a difference.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (4 ratings)
Loading.
ankbhasi Mon, 08/06/2007 - 07:47
User Badges:
  • Cisco Employee,

Hi Wilson,


Looks like SPAN suits your requirement if your ATM port and DVM equipment port exist on same switch or else you need RSPAN which is Remote Span.


Also by default the destination is always in monitoring state and only gets the mirrored data from source port but if you add "ingress" keyword at the end of span destination command then it can work as both monitoring port as well as for normal vlan which you configure with ingress keyword.


HTH


Ankur


*Pls rate all helpfull post

wilson_1234_2 Mon, 08/06/2007 - 09:43
User Badges:

Thanks for the reply.


So this is what i am looking at below. Is there anything that needs to be specified after "ingress"?


Also, I am looking to mirroe the ATM (port5) to the DVM (port 4) and still have the DVM communicate on the network.


Is that correct?


monitor session 1 source interface f0/5 both

monitor session 1 destination interface f0/4 ingress

sundar.palaniappan Mon, 08/06/2007 - 10:45
User Badges:
  • Green, 3000 points or more

That should work with one slight modification to the syntax, for ingress forwarding you need to specify a default VLAN for untagged traffic. Let's say if the DVM port (port 4) is an access port on vlan 4 then use vlan 4 as the default vlan with ingress forwarding.


SW1-3550(config)#monitor session 1 destination interface f0/4 ingress ?

vlan Set default VLAN for untagged ingress traffic


SW1-3550(config)#monitor session 1 destination interface f0/4 ingress vlan ?

<1-4094> Default VLAN for untagged ingress traffic


SW1-3550(config)#monitor session 1 destination interface f0/4 ingress vlan 4


HTH


Sundar

wilson_1234_2 Mon, 08/06/2007 - 11:10
User Badges:

Thanks Sundar


as usual, great information.


Regarding your comment on the default vlan, does it matter that everything is in VLAN1 at that site at the moment?


All ports regarding the ATM are in VLAN1, would I still use VLAN1 in the syntax after ingress?


ankbhasi Mon, 08/06/2007 - 20:54
User Badges:
  • Cisco Employee,

Hi Wilson,


Yes even thoug all the ports are default in vloan 1 but after configuring destination port in SPAN the port goes into monitoring state so to make it also active for data traffic you have to specify some vlan number with ingress command so you can specify vlan 1 after ingress keyword.


HTH


Ankur

sundar.palaniappan Tue, 08/07/2007 - 06:10
User Badges:
  • Green, 3000 points or more

Wilson,


Thanks for the comment and the rating.


Ankur is correct. Though by default all ports are on vlan1 you still to configure vlan 1 after the ingress keyword if that's the VLAN the device connected is part of.


HTH


Sundar

Actions

This Discussion