SPAN configuration on switch 2950

josephn · ‎04-04-2008

Hi,

I had enabled span port on the CAT 2950 switch to capture some traffic flows from a specific source port. I had connected Packet Shaper to the destination port.

For the source port, I had enabled for both (tx and rx) traffics.

My Packet Shaper report only shows inbound traffic. There is very little traffic detected on the outbound.

For your information, I didn't configured for ingress traffic on the destination port. Can this be the problem ?

How to report correctly for both inbound and outbound on the Packet Shaper. The Packet Shaper is configured in watch mode.

Please help.

Joseph

Joe Clarke · ‎04-04-2008

But there is outbound traffic being detected? What is connected to the monitored port? If a multi-homed host, perhaps it is sending the reply traffic out of a different interface.

josephn · ‎05-19-2008

Hi,

Here is the snapshot after configuring the span port:

FastEthernet0/3 is up, line protocol is down (monitoring)

Hardware is Fast Ethernet, address is 000c.3087.e003 (bia 000c.3087.e003)

Description: Packetshaper(10.192.1.22) outside

MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec,

reliability 255/255, txload 27/255, rxload 1/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full-duplex, 100Mb/s

input flow-control is off, output flow-control is off

ARP type: ARPA, ARP Timeout 04:00:00

Last input 13w5d, output 00:33:21, output hang never

Last clearing of "show interface" counters never

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

30 second input rate 0 bits/sec, 0 packets/sec

30 second output rate 10957000 bits/sec, 2336 packets/sec

553375 packets input, 260543901 bytes, 0 no buffer

Received 115206 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 98598 multicast, 0 pause input

0 input packets with dribble condition detected

1620444074 packets output, 800717686 bytes, 0 underruns

0 output errors, 0 collisions, 19 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

Sorry, there is no traffic on the inbound.

regards,

Joe Clarke · ‎05-20-2008

The monitor port should only have outbound traffic as the probe is most likely not generating any traffic of its own on that port. My previous questions were about the port being monitored.

josephn · ‎05-20-2008

Hi,

Here is the configuration for span on the switch:

monitor session 1 source interface Fa0/6

monitor session 1 destination interface Fa0/3

The source interface fa0/6 belong to vlan 10 as below:

10 VLAN0010 active Fa0/3, Fa0/4, Fa0/6, Fa0/19, Fa0/20, Fa0/22

FastEthernet0/6 is up, line protocol is up (connected)

Hardware is Fast Ethernet, address is 000c.3087.e006 (bia 000c.3087.e006)

Description: Cisco2821 - 30M MetroE to Sinhub

MTU 1500 bytes, BW 100000 Kbit, DLY 1000 usec,

reliability 255/255, txload 10/255, rxload 14/255

Encapsulation ARPA, loopback not set

Keepalive set (10 sec)

Full-duplex, 100Mb/s

input flow-control is off, output flow-control is off

ARP type: ARPA, ARP Timeout 04:00:00

Last input 00:00:21, output 00:00:00, output hang never

Last clearing of "show interface" counters never

Input queue: 1/75/0/0 (size/max/drops/flushes); Total output drops: 0

Queueing strategy: fifo

Output queue :0/40 (size/max)

30 second input rate 5714000 bits/sec, 1156 packets/sec

30 second output rate 4122000 bits/sec, 979 packets/sec

131914122 packets input, 2655520328 bytes, 0 no buffer

Received 18729043 broadcasts, 0 runts, 0 giants, 0 throttles

0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 3582795 multicast, 3763 pause input

0 input packets with dribble condition detected

482803327 packets output, 885450104 bytes, 0 underruns

0 output errors, 0 collisions, 4 interface resets

0 babbles, 0 late collision, 0 deferred

0 lost carrier, 0 no carrier, 0 PAUSE output

0 output buffer failures, 0 output buffers swapped out

Session 1

---------

Type : Local Session

Source Ports :

Both : Fa0/6

Destination Ports : Fa0/3

Encapsulation: Native

Ingress: Disabled

Thanks.

Joseph