Switchport Traffic capture

Answered Question

Hi I have a Cisco Catalyst WS-C3548-XL-EN. My company has third party software that resides on our desktop machines that enables remote session within the LAN. some users think that there is something scanning our netowork and trying to connect remotely within the network. Is their a way that I can mirror a port to another and capture the traffic or look at a specfic port and see what is trying to connect?


TIA

Mike

Correct Answer by Mark Yeates about 8 years 10 months ago

Mike,


The 3550XL series switches are a little different than most other switches to SPAN switchports. Make sure the user port and the sniffer port is on the same VLAN. Here is an example of spanning a port where 0/1 is the user, and 0/2 is the sniffer.



int fa0/2

port monitor fa0/1



Mark



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Mark Yeates Mon, 06/16/2008 - 18:13
User Badges:
  • Gold, 750 points or more

Mike,


The 3550XL series switches are a little different than most other switches to SPAN switchports. Make sure the user port and the sniffer port is on the same VLAN. Here is an example of spanning a port where 0/1 is the user, and 0/2 is the sniffer.



int fa0/2

port monitor fa0/1



Mark



Actions

This Discussion