Lost connectivity after setting up SPAN

brooklynheight · ‎03-04-2008

I sit on fe 0/18 and I was trying to span fe 0/15 becuase im trying to learn sniffers etc..however after I created the span my port shut down-only after did i directly console into the 2950 did the port come back up-this is what i created-

2950(config)#monitor session 1 source interface fastEthernet 0/15 both

2950(config)#monitor session 1 destination interface fastEthernet 0/18

after i hit enter i lost my LAN connection.

I had to console-disable the session

11w2d: %SYS-5-CONFIG_I: Configured from console by console

11w2d: %LINK-3-UPDOWN: Interface FastEthernet0/18, changed state to up

11w2d: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/18, changed

state to up

Im not sure why this came up like this after

i disabled the session-the only thing on the other end of the lan cable is a docking station becuase my laptop was directly consoled into the switch

american1 · ‎03-04-2008

When creating a SPAN port, the destination port will be in the up/down state. You will only be able to look down onto the switch not pass any traffic.

brooklynheight · ‎03-04-2008

so if i had wireshark on my pc-i would still see

traffice from the source even though my port is in an updown?

and what would the workaround to getting back "online" per se...do i have to console in everytime?

american1 · ‎03-04-2008

Yes you will be able see/capture to the traffic even know the datalink layer is in the down state.

You could vty in from a workstation that is on a different port on the switch.

If that is not an option you will have will have to console in.

After setting up a SPAN, the destination port of the monitoring session will automatically go into the up/down state, no L2 traffic is allowed.

brooklynheight · ‎03-05-2008

thx for the info...If im doing a remote span..and I only have one one trunk/physical connection

going from switch A to B to C-all on vlan1

switchC---trunk---switchB---trunk---switchA----router

The source is on switch C and the destination is on A

Will all device/hosts lose connectivity to the router which is connected to switch A because

the trunks become reflectors?

Julio E. Moisa · ‎03-22-2017

Hi

As I have working the sniffers is, left the destination port like by default, not configuration at all, because it will be used for sniffing only. Now Usually the server have 2 NICs, one for management and the other one for sniffer.

Hope it is useful.

:-)

>> Marcar como útil o contestado, si la respuesta resolvió la duda, esto ayuda a futuras consultas de otros miembros de la comunidad. <<

John Rener · ‎03-22-2017

I now have this issue, I thought (using your example)

2950(config)#monitor session 1 source interface fastEthernet 0/15 both <-- target port/PC

2950(config)#monitor session 1 destination interface fastEthernet 0/18 <-- sniffing port/wireshark

May I know what was your solution or final thoughts?

jamband764 · ‎03-22-2017

This is standard behaviour for SPAN destination ports. You can't remain connected to the LAN whilst being a SPAN destination port unless you have more than one NIC on your client.