cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
737
Views
10
Helpful
3
Replies

SPAN session tx or rx question

wilson_1234_2
Level 3
Level 3

When configuring a SPAN session for a single direction on core 6509:

monitor session 1 source vlan 1, 5 , 7, 9 rx

Monitor session 1 destination interface g1/1

VLAN 5 is uplink to Firrewall/Internet

VLAN 7 is workstation VLAN

If a workstation is attempting to connect to an FTP server on the Internet, would I see any traffic on VLAN 5 in the rx direction?

Or does the SPAN session only see traffic sourced from the FTP server?

It the traffic is outbound to the FTP server, would there be any rx traffic inbound  on the VLAN 5 port?

3 Replies 3

Edison Ortiz
Hall of Fame
Hall of Fame

If a workstation is attempting to connect to an FTP server on the Internet, would I see any traffic on VLAN 5 in the rx direction?

No, you will see traffic on Vlan 7 on the rx

Or does the SPAN session only see traffic sourced from the FTP server?

Vlan 5 (internet Vlan) will capture all received traffic from the internet so return traffic from the FTP server will be captured.

Thanks Edison, that is what I suspected.

But I was wondering (and I hope this is not a stupid question)

There will always be some return traffic from the Internet that gets captured rx on the VLAN 5 port, no matter who initiates the connection?

Since this is tcp, there will always be return traffic seen on the rx on SPAN 1 VLAN 5 from the Internet, correct?

Yes you are rite you can see the traffic coming back from ftp server for ACK to source in internet facing vlan
and traffic which is initiated to ftp server from host from host vlan also.

Regards
Ganesh.H

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: