CSS11503 - WIsh to span ports and capture packets using Wireshark

astanislaus · ‎02-22-2008

Question 1:

============

We are troubleshooting an issue and wish to capture packets to/from CSS. Unfortunately we have a CSS which only has the following and do not have spare port to span to and connect Laptops running Wireshark.

CSS(debug)# show chassis verbose

Configuration for CSS11503-AC E0:

Product Name: CSS11503-AC E0 SW Version: 07.50.0.04

Serial Number: JAB0700Q0GG Base Mac Address: 00-0d-ed-e5-1a-1e

Module(s) Found: 2

Power Supplies(s) Found: 1

Fan(s) Found: 4

Slot/SubSlot Operational Locked

1/1 *07.50.0.04 07.50.0.04

Slot Number: 1 Type: CSS5-SCM-2GE F0

Serial Number: JAB091504L7 Number of Ports: 2

Operational Status: primary

Port Number: 1 Port Name: SCM-2GE

Operational Status online

Port Number: 2 Port Name: SCM-2GE

Operational Status online

Slot Number: 4 Type: CSS503-SM-INT

Serial Number: JAB073805KH Number of Ports: 0

Operational Status: powered-on

I want to make sure we buy the right parts to be able to span traffic to/from 1/1 and 1/2. I think all I need are:

CSS5-IOM-2GE - QUANTITY 1

and

GCL-T - QUANTITY 2

IS GLC-T the correct part number or do I need some other part number to connect Laptops with 100/1000 NIC cards.

Question 2:

===========

Can I simultaneously span 1/1 to 2/1

and 1/2 to 2/2 when I install CSS5-IOM-2GE in slot 2 or can I span only one port at a time.

VErsion of CSS11503 is sg0750004.

astanislaus · ‎02-22-2008

1. Does setspan work only if source and destination ports are on same module or can the source and destination ports be on different modules.

2. Can 1/1 to 2/1 and 1/2 to 2/2 be spanned at the same time?

astanislaus · ‎02-22-2008

Sorry - last question. Are the I/O modules hot swappable in CSS 11503. I didn't think so.

pknoops · ‎02-22-2008

Hi,

As far as doing SPAN on the CSS, it would need to be on the same module. You can find a very good explanation at this link:

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/css11500series/v7.40/configuration/routing/guide/Intface.html#wp1099744

Also, the modules on the CSS are not HOT SWAP.

Regards

Peter

astanislaus · ‎02-22-2008

Peter,

Thanks for the reply:

1) Are the P/Ns I posted right.

So I would have to modify my current config to:

!************************* INTERFACE *************************

interface 1/1

bridge vlan 3

description "connects to Customer network"

interface 1/2 (this would have to be changed to interface 2/1 so that we can span 1/1 to 1/2 and span 2/1 to 2/2)

bridge vlan 2

***********************************************************************

pknoops · ‎02-22-2008

The part number you show is a 2GE blade for the 11500 series, which should be fine.

So if I read this config correctly, you are moving one end of your traffic to the new blade and thus be able to span one port on each blade to see traffic from the customer network on one sniff and traffic on the other vlan will be sniffed by spanning the port on the second blade. This looks great to me..

Regards

Pete..

astanislaus · ‎02-22-2008

Peter,

Is the SFP for UTP a standard GLC-T that we use in other Cisco Products.

Regards

Alphonse