CSS11503 - WIsh to span ports and capture packets using Wireshark

Unanswered Question
Feb 22nd, 2008

Question 1:

============

We are troubleshooting an issue and wish to capture packets to/from CSS. Unfortunately we have a CSS which only has the following and do not have spare port to span to and connect Laptops running Wireshark.

CSS(debug)# show chassis verbose

Configuration for CSS11503-AC E0:

Product Name: CSS11503-AC E0 SW Version: 07.50.0.04

Serial Number: JAB0700Q0GG Base Mac Address: 00-0d-ed-e5-1a-1e

Module(s) Found: 2

Power Supplies(s) Found: 1

Fan(s) Found: 4

Slot/SubSlot Operational Locked

1/1 *07.50.0.04 07.50.0.04

Slot Number: 1 Type: CSS5-SCM-2GE F0

Serial Number: JAB091504L7 Number of Ports: 2

Operational Status: primary

Port Number: 1 Port Name: SCM-2GE

Operational Status online

Port Number: 2 Port Name: SCM-2GE

Operational Status online

Slot Number: 4 Type: CSS503-SM-INT

Serial Number: JAB073805KH Number of Ports: 0

Operational Status: powered-on

I want to make sure we buy the right parts to be able to span traffic to/from 1/1 and 1/2. I think all I need are:

CSS5-IOM-2GE - QUANTITY 1

and

GCL-T - QUANTITY 2

IS GLC-T the correct part number or do I need some other part number to connect Laptops with 100/1000 NIC cards.

Question 2:

===========

Can I simultaneously span 1/1 to 2/1

and 1/2 to 2/2 when I install CSS5-IOM-2GE in slot 2 or can I span only one port at a time.

VErsion of CSS11503 is sg0750004.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (2 ratings)
Loading.
astanislaus Fri, 02/22/2008 - 07:10

1. Does setspan work only if source and destination ports are on same module or can the source and destination ports be on different modules.

2. Can 1/1 to 2/1 and 1/2 to 2/2 be spanned at the same time?

astanislaus Fri, 02/22/2008 - 07:26

Sorry - last question. Are the I/O modules hot swappable in CSS 11503. I didn't think so.

astanislaus Fri, 02/22/2008 - 08:37

Peter,

Thanks for the reply:

1) Are the P/Ns I posted right.

So I would have to modify my current config to:

!************************* INTERFACE *************************

interface 1/1

bridge vlan 3

description "connects to Customer network"

interface 1/2 (this would have to be changed to interface 2/1 so that we can span 1/1 to 1/2 and span 2/1 to 2/2)

bridge vlan 2

***********************************************************************

pknoops Fri, 02/22/2008 - 08:43

The part number you show is a 2GE blade for the 11500 series, which should be fine.

So if I read this config correctly, you are moving one end of your traffic to the new blade and thus be able to span one port on each blade to see traffic from the customer network on one sniff and traffic on the other vlan will be sniffed by spanning the port on the second blade. This looks great to me..

Regards

Pete..

astanislaus Fri, 02/22/2008 - 09:08

Peter,

Is the SFP for UTP a standard GLC-T that we use in other Cisco Products.

Regards

Alphonse

Actions

This Discussion