I am trying to troubleshoot static on VOIP phones (sorry, Nortel phone sets, I know, I should have chosen Cisco). We have a Nortel BCM 400. It has two ethernet connections: one for management, one for voice traffic. The voice trafffic line is plugged into port fa0/46 on a Cisco 2950. That port is in vlan 2. All other fast ethernet ports are in trunking mode. The management interface (vlan1) is the data vlan. 192.168.11.0/24 is data. The BCM is the dchp server for the phones, it hands out IP addresses in this range to the phones: 10.11.250.0/24. At a typical desk, the VOIP phones are plugged into the datajack and then the computers are plugged into the phone. I want to capture the traffic for one phone set. That is, capture all the traffic between one phone set and the BCM. Of course, I don't want to see vlan 1 traffic, just vlan 2(voip) traffic.

Let's say fa0/5 is free and I can plug my laptop into that port and run Wireshark on the laptop. fa0/6 is the port that the phone is connected into. Will the following config work?

int fa0/5

port monitor fa0/46

port monitor fa0/6

I know that you cannot span a port if the source and destination are in different vlans, but what about a trunk port?

port fa0/5 (the destination port) is in trunk mode. The first monitored port, fa0/46, is in vlan 2, and the second monitored port, fa0/6, is in trunk mode.