Query on Switch port(s) span

Unanswered Question
Jun 18th, 2010
User Badges:
  • Gold, 750 points or more

Hi All,


Switch 1 (3560G) : Vlan 20, 30.50  --> Uplink --> Core Switch


Switch 2(3560G) : Vlan 25, 30.50  --> Uplink --> Core Switch



I want to span the few ports on switch1 from Vla 30.

Is it recomend to  span the Vla30 as source port on Switch1 (destination port on same SW attached with sniffer) OR to set the uplink (trunk) port as Source port?


Also, of I span vla30 as source, it does not get any traffic from another switches (Sw2) vla30. is that correct?


TIA

MS

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
sarabbi Wed, 06/23/2010 - 14:27
User Badges:

As for making source of SPAN vlan 30 on Sw1 or making it uplink on Sw1, it depends on what you're trying to capture.  Each option will show different information.


Option1:

monitor session 1 source vlan 30


Option2:

monitor session 1 source int g0/1 <- this is sample uplink on Sw1 to core


Option 1 above will show you all packets received or sent by Sw1 in vlan 30.  So if fasteth0/1 is access port in vlan 30, and a packets comes in on fast0/1 and then is sent out of gig0/1 trunk in vlan 30, you will see the packet twice in the traffic capture.


Option 2 above will show you all packets in all vlans going in and out of gig0/1 by default.  You can modify this using additional configuration commands.


Here's a good reference link below:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_37_se/configuration/guide/swspan.html#wp1210541

Actions

This Discussion