03-04-2008 07:35 AM - edited 03-05-2019 09:32 PM
I sit on fe 0/18 and I was trying to span fe 0/15 becuase im trying to learn sniffers etc..however after I created the span my port shut down-only after did i directly console into the 2950 did the port come back up-this is what i created-
2950(config)#monitor session 1 source interface fastEthernet 0/15 both
2950(config)#monitor session 1 destination interface fastEthernet 0/18
after i hit enter i lost my LAN connection.
I had to console-disable the session
11w2d: %SYS-5-CONFIG_I: Configured from console by console
11w2d: %LINK-3-UPDOWN: Interface FastEthernet0/18, changed state to up
11w2d: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/18, changed
state to up
Im not sure why this came up like this after
i disabled the session-the only thing on the other end of the lan cable is a docking station becuase my laptop was directly consoled into the switch
03-04-2008 07:59 AM
When creating a SPAN port, the destination port will be in the up/down state. You will only be able to look down onto the switch not pass any traffic.
03-04-2008 08:24 AM
so if i had wireshark on my pc-i would still see
traffice from the source even though my port is in an updown?
and what would the workaround to getting back "online" per se...do i have to console in everytime?
03-04-2008 08:34 AM
Yes you will be able see/capture to the traffic even know the datalink layer is in the down state.
You could vty in from a workstation that is on a different port on the switch.
If that is not an option you will have will have to console in.
After setting up a SPAN, the destination port of the monitoring session will automatically go into the up/down state, no L2 traffic is allowed.
03-05-2008 06:36 AM
thx for the info...If im doing a remote span..and I only have one one trunk/physical connection
going from switch A to B to C-all on vlan1
switchC---trunk---switchB---trunk---switchA----router
The source is on switch C and the destination is on A
Will all device/hosts lose connectivity to the router which is connected to switch A because
the trunks become reflectors?
03-22-2017 01:40 PM
Hi
As I have working the sniffers is, left the destination port like by default, not configuration at all, because it will be used for sniffing only. Now Usually the server have 2 NICs, one for management and the other one for sniffer.
Hope it is useful.
:-)
03-22-2017 01:36 PM
I now have this issue, I thought (using your example)
2950(config)#monitor session 1 source interface fastEthernet 0/15 both <-- target port/PC
2950(config)#monitor session 1 destination interface fastEthernet 0/18 <-- sniffing port/wireshark
May I know what was your solution or final thoughts?
03-22-2017 04:59 PM
This is standard behaviour for SPAN destination ports. You can't remain connected to the LAN whilst being a SPAN destination port unless you have more than one NIC on your client.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide