SPAN on CAT 3550 shows only one way traffic

Unanswered Question
Jul 14th, 2008

interface FastEthernet0/6

switchport access vlan 30

switchport mode access

duplex full

speed 100


interface FastEthernet0/12

switchport access vlan 20

switchport mode access


monitor session 1 source interface fa0/6

monitor session 1 destination interface fa0/12


We only see one way traffice with Ethereal connected to fa0/12


I have done this many times before and never had any problem. But I am not sure what model switch I have done this before on. May be not a 3550.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
astanislaus Mon, 07/14/2008 - 21:42

We also modified fa0/12 config as follows and still same problem:


interface FastEthernet0/12

switchport access vlan 30 (i.e. same VLAN as fa0/6, although I thought it shouldn't matter)

switchport mode access


astanislaus Mon, 07/14/2008 - 22:48

Unfortunately when I got to be told about the problem the customer had done - no monitor session 1 by then.


But customer says - When he had the monitor session 1 commands he had the following output:


sh mon sess 1


Session 1

---------

Type : Local Session

Source Ports : Fa0/6

Destination Ports : Fa0/12

Encapsulation : Native

I asked him if he had seen anything like Ingress or Egress disabled and he says he does seem to recall seeing that.


We will try again to see what the output of show monitor session 1 command is after tunrining on monitoring.


astanislaus Tue, 07/15/2008 - 17:33

I tried to simulate this problem in our lab and I configured as follows and show monitor shows as follows. Why does it show ingress disabled.


arvproctors01#show run | begin monitor

monitor session 1 source interface Fa0/6

monitor session 1 destination interface Fa0/12

!

end


arvproctors01#sho mon

Session 1

---------

Type : Local Session

Source Ports :

Both : Fa0/6

Destination Ports : Fa0/12

Encapsulation : Native

Ingress : Disabled



arvproctors01#

garytayl Tue, 07/15/2008 - 18:13

Ingress is disabled by default however, do not get confused with t he traffic being monitored. It means that port fa 0/12 will not work as a regular port therefore won't receive packets, it is only monitoring. If you want to monitor traffic and use that port to receive regular traffic then you should used:


monitor session 1 destination interface fastethernet0/12 ingress vlan X



Gary

Actions

This Discussion