spanning an 802.1x port

Unanswered Question

I'm trying to set up a SPAN on a 802.1x port as the source. I'm trying to capture the 802.1x EAP conversation going back and forth and am only seeing one side of the conversation, from the host to the switch. I'm not seeing anything from the switch back to the host.

If I do a capture on the machine that is 802.1xing, I see both sides of the convo, host to switch and switch to host.

It was set up as follows:

monitor session 1 source interface fa1/0/44 both

monitor session 1 destination interface fa2/0/38

Anyone have any ideas?Everything I read on Cisco looks like 802.1x ports can be used as source ports.

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Elly Bornstein Tue, 02/03/2009 - 12:25

Are you seeing bidirectional traffic at all? or just missing EAPOL?

Try pinging to this device while doing a span of both directions, see if one leg of the traffic is missing.

If one direction of traffic is missing for a 'both' SPAN session, I would open a TAC case they can help you identify the problem. I am saying this for they will need to collect more info from you.


This Discussion