cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
391
Views
0
Helpful
1
Replies

Switchport Traffic capture

mhaden
Level 1
Level 1

Hi I have a Cisco Catalyst WS-C3548-XL-EN. My company has third party software that resides on our desktop machines that enables remote session within the LAN. some users think that there is something scanning our netowork and trying to connect remotely within the network. Is their a way that I can mirror a port to another and capture the traffic or look at a specfic port and see what is trying to connect?

TIA

Mike

1 Accepted Solution

Accepted Solutions

Mark Yeates
Level 7
Level 7

Mike,

The 3550XL series switches are a little different than most other switches to SPAN switchports. Make sure the user port and the sniffer port is on the same VLAN. Here is an example of spanning a port where 0/1 is the user, and 0/2 is the sniffer.

int fa0/2

port monitor fa0/1

Mark

View solution in original post

1 Reply 1

Mark Yeates
Level 7
Level 7

Mike,

The 3550XL series switches are a little different than most other switches to SPAN switchports. Make sure the user port and the sniffer port is on the same VLAN. Here is an example of spanning a port where 0/1 is the user, and 0/2 is the sniffer.

int fa0/2

port monitor fa0/1

Mark

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco