SPAN on Cat2950, ports in trunk mode, vlan 1&2, data&voip

Unanswered Question
Jul 14th, 2008

I am trying to troubleshoot static on VOIP phones (sorry, Nortel phone sets, I know, I should have chosen Cisco). We have a Nortel BCM 400. It has two ethernet connections: one for management, one for voice traffic. The voice trafffic line is plugged into port fa0/46 on a Cisco 2950. That port is in vlan 2. All other fast ethernet ports are in trunking mode. The management interface (vlan1) is the data vlan. is data. The BCM is the dchp server for the phones, it hands out IP addresses in this range to the phones: At a typical desk, the VOIP phones are plugged into the datajack and then the computers are plugged into the phone. I want to capture the traffic for one phone set. That is, capture all the traffic between one phone set and the BCM. Of course, I don't want to see vlan 1 traffic, just vlan 2(voip) traffic.

Let's say fa0/5 is free and I can plug my laptop into that port and run Wireshark on the laptop. fa0/6 is the port that the phone is connected into. Will the following config work?

int fa0/5

port monitor fa0/46

port monitor fa0/6

I know that you cannot span a port if the source and destination are in different vlans, but what about a trunk port?

port fa0/5 (the destination port) is in trunk mode. The first monitored port, fa0/46, is in vlan 2, and the second monitored port, fa0/6, is in trunk mode.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Joe Clarke Mon, 07/14/2008 - 15:12

The destination port should not be a trunk port. For safety reasons, it should be a transmit-only (i.e. ingress traffic should be disabled) port that you use for a probe (or in this case a laptop running Wireshark).

But, the following should work:

monitor session 1 source interface Fa0/6 , Fa0/46

monitor session 1 destination interface Fa0/5


This Discussion