Monitor session

Unanswered Question
Jul 14th, 2008
User Badges:

I'm trying to monitor and record VoiP calls in my network. These are the commands that i passed on the Switch A

monitor session 1 source vlan 3 both

monitor session 1 destination int gi0/15 ingress vlan 3

vlan 3 is the telephone vlan and port 15 is where the voice recorder is connected.

If the call is between 2 phones on Switch A, monitoring and recording are done perfectly.

If the call is between a phone on Switch A and a phone on other switch i'm getting half monitoring. It's only monitoring on side of the call. The RTP traffic on Ethereal is showing one direction.

Do you have any idea about this issue?

Note: Call Manager Express is also on Switch A

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Giuseppe Larosa Mon, 07/14/2008 - 12:18
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Walid,

first of all I would change the second command

monitor session 1 destination int gi0/15

you have already specified what you want to capture in the first command and the ingress option could introduce some filtering action.

When you try to monitor a call between a phone on switch A and a phone on another switch are both in Vlan3 ?

Hope to help


valides007 Tue, 07/15/2008 - 04:45
User Badges:


First i tried the second command without ingress and i'm still getting the same result.

I understand both phones are in Vlan3 and that why i'm getting confused. I don't see why this thing doesn't work.

It seems that whenever there is call between phones from different switches the SPAN is monitoring only 1 direction of the traffic and you can see this clearly on Ethereal.

This is so frustrating.......

mahmoodmkl Tue, 07/15/2008 - 04:52
User Badges:
  • Gold, 750 points or more


I think u need to use RSPAN for this as the devices r connected on different switches.



Giuseppe Larosa Tue, 07/15/2008 - 09:27
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member


just to make a try you could try to use as source the physical port where the phone on Switch A is connected with the both options.

In this case you should see both ends of communication in any case.

Of course this is less flexible.

Hope to help


garytayl Tue, 07/15/2008 - 11:13
User Badges:
  • Silver, 250 points or more


Lets remember what is the purpose of SPAN:

-Local SPAN supports a SPAN session entirely within one switch; all source ports or source VLANs and destination ports reside in the same switch.

In regards to RSPAN, documentation specifies:

RSPAN supports source ports, source VLANs, and destination ports on different switches, enabling remote monitoring of multiple switches across your network

From the explanation above, RSPAN might help you out, but be aware that RSPAN is not available on the Catalyst 3500, 2900, or 3524-PWR switches.

You may also want to look at following doc with more detail information on how to accomplish this using specialized software:




This Discussion