cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
665
Views
0
Helpful
4
Replies

How to get more than two monitor sessions on 3750G

chuck007
Level 1
Level 1

We are deploying several (6) IDS sensors to monitor traffic on various VLANs on the core router/switch 3750Gs. I can only do two SPAN monitor sessions. Is there a workaround with SPAN or RSPAN so I can mirror/capture traffic for the many IDS sensors? Thanks.

4 Replies 4

Collin Clark
VIP Alumni
VIP Alumni

Physical taps can help. Google 'network tap' for mfg's.

HTH and please rate.

Yes, I thought about physical taps for the router links. But as for the many VLANs that live on the core router, I won't be able to tap in. Anyway around it?

I would think that their higher-end products you would be able to trunk multiple VLANS to a single TAP. We span multiple source VLANs to a single destination port for IDS.

CORE1#sh mon

Session 1

---------

Type : Local Session

Source VLANs :

Both : 26,30,104,300,603

Destination Ports : Gi7/1

The 3750Gs can do multiple source and multiple destinations, but only 2 sessions. Thus I can only do a source-destination pair session only twice. I may just have to SPAN many VLANs and ports, and then have the IDS sensors filter out the unwanted traffic as needed. I'm trying to see if RSPAN can overcome this limitation. Keep the ideas flowing. Thanks.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: