SPAN session on CAT 2950

wilson_1234_2 · ‎08-06-2007

I have a question about setting up a SPAN session:

We have a banking ATM that needs to have all transaction data superimposed on the DVM monitoring images.

Accroding to the ATM people:

"The DVR device needs to be deployed onto a mirror port of the ATM. In this manner as the ATM transaction is mirrored onto the DVR port the message stream can be parsed for the transaction data so that it may be superimposed onto the DVR image."

My understanding of this is that it would be a simple monitor session configured to monitor the ATM port and mirror it onto the destination port, which is where the DVM equipment will be plugged into the switch.

If that is that case, can I still communicate with the DVM equipment if it is plugged into a mirror port?

Is the session destination port still active on the network like any other port, just has the data from both ports on it?

The link to the router is trunking two vlans on the switch, not sure if that makes a difference.

ankbhasi · ‎08-06-2007

Hi Wilson,

Looks like SPAN suits your requirement if your ATM port and DVM equipment port exist on same switch or else you need RSPAN which is Remote Span.

Also by default the destination is always in monitoring state and only gets the mirrored data from source port but if you add "ingress" keyword at the end of span destination command then it can work as both monitoring port as well as for normal vlan which you configure with ingress keyword.

HTH

Ankur

*Pls rate all helpfull post

wilson_1234_2 · ‎08-06-2007

Thanks for the reply.

So this is what i am looking at below. Is there anything that needs to be specified after "ingress"?

Also, I am looking to mirroe the ATM (port5) to the DVM (port 4) and still have the DVM communicate on the network.

Is that correct?

monitor session 1 source interface f0/5 both

monitor session 1 destination interface f0/4 ingress

sundar.palaniappan · ‎08-06-2007

That should work with one slight modification to the syntax, for ingress forwarding you need to specify a default VLAN for untagged traffic. Let's say if the DVM port (port 4) is an access port on vlan 4 then use vlan 4 as the default vlan with ingress forwarding.

SW1-3550(config)#monitor session 1 destination interface f0/4 ingress ?

vlan Set default VLAN for untagged ingress traffic

SW1-3550(config)#monitor session 1 destination interface f0/4 ingress vlan ?

<1-4094> Default VLAN for untagged ingress traffic

SW1-3550(config)#monitor session 1 destination interface f0/4 ingress vlan 4

HTH

Sundar

wilson_1234_2 · ‎08-06-2007

Thanks Sundar

as usual, great information.

Regarding your comment on the default vlan, does it matter that everything is in VLAN1 at that site at the moment?

All ports regarding the ATM are in VLAN1, would I still use VLAN1 in the syntax after ingress?

ankbhasi · ‎08-06-2007

Hi Wilson,

Yes even thoug all the ports are default in vloan 1 but after configuring destination port in SPAN the port goes into monitoring state so to make it also active for data traffic you have to specify some vlan number with ingress command so you can specify vlan 1 after ingress keyword.

HTH

Ankur

sundar.palaniappan · ‎08-07-2007

Wilson,

Thanks for the comment and the rating.

Ankur is correct. Though by default all ports are on vlan1 you still to configure vlan 1 after the ingress keyword if that's the VLAN the device connected is part of.

HTH

Sundar