Lost connectivity after setting up SPAN

Unanswered Question
Mar 4th, 2008
User Badges:

I sit on fe 0/18 and I was trying to span fe 0/15 becuase im trying to learn sniffers etc..however after I created the span my port shut down-only after did i directly console into the 2950 did the port come back up-this is what i created-

2950(config)#monitor session 1 source interface fastEthernet 0/15 both

2950(config)#monitor session 1 destination interface fastEthernet 0/18

after i hit enter i lost my LAN connection.

I had to console-disable the session

11w2d: %SYS-5-CONFIG_I: Configured from console by console

11w2d: %LINK-3-UPDOWN: Interface FastEthernet0/18, changed state to up

11w2d: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/18, changed

state to up

Im not sure why this came up like this after

i disabled the session-the only thing on the other end of the lan cable is a docking station becuase my laptop was directly consoled into the switch

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
american1 Tue, 03/04/2008 - 07:59
User Badges:

When creating a SPAN port, the destination port will be in the up/down state. You will only be able to look down onto the switch not pass any traffic.

brooklynheight Tue, 03/04/2008 - 08:24
User Badges:

so if i had wireshark on my pc-i would still see

traffice from the source even though my port is in an updown?

and what would the workaround to getting back "online" per se...do i have to console in everytime?

american1 Tue, 03/04/2008 - 08:34
User Badges:

Yes you will be able see/capture to the traffic even know the datalink layer is in the down state.

You could vty in from a workstation that is on a different port on the switch.

If that is not an option you will have will have to console in.

After setting up a SPAN, the destination port of the monitoring session will automatically go into the up/down state, no L2 traffic is allowed.

brooklynheight Wed, 03/05/2008 - 06:36
User Badges:

thx for the info...If im doing a remote span..and I only have one one trunk/physical connection

going from switch A to B to C-all on vlan1


The source is on switch C and the destination is on A

Will all device/hosts lose connectivity to the router which is connected to switch A because

the trunks become reflectors?

Julio Moisa Wed, 03/22/2017 - 13:40
User Badges:
  • Gold, 750 points or more


As I have working the sniffers is, left the destination port like by default, not configuration at all, because it will be used for sniffing only. Now Usually the server have 2 NICs, one for management and the other one for sniffer.

Hope it is useful.


John Rener Wed, 03/22/2017 - 13:36
User Badges:

I now have this issue, I thought (using your example)

2950(config)#monitor session 1 source interface fastEthernet 0/15 both <-- target port/PC

2950(config)#monitor session 1 destination interface fastEthernet 0/18 <-- sniffing port/wireshark

May I know what was your solution or final thoughts?

jamband764 Wed, 03/22/2017 - 16:59
User Badges:

This is standard behaviour for SPAN destination ports. You can't remain connected to the LAN whilst being a SPAN destination port unless you have more than one NIC on your client.


This Discussion