SPAN on Multiple Ports

Answered Question
Aug 14th, 2013
User Badges:

On a 3560 or 3750 is it possible to SPAN multiple ports in 1 session to 1 destination port, with both tx and rx packets?  So this:


#monitor session 4 source int f0/2 - 10 both

monitor session 4 dest   int f0/11


I'm able to enter the commands, but when I do a "sh monitor 4"  it says that ingress is disabled.

Correct Answer by devils_advocate about 4 years 2 days ago

Ingress in Lei's example above relates to the destination port, i.e ensures the destination port can only recieve packets and not transmit them so thats perfectly normal.

Correct Answer by Lei Tian about 4 years 2 days ago

Hi,


works on my 3560. Maybe some code issue.


CORE-SW1#sh ver | i IOS    

Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1)

CORE-SW1#sh monitor session all

Session 1

---------

Type                   : Local Session

Source Ports           :

    Both               : Fa0/1-20

Destination Ports      : Fa0/21

    Encapsulation      : Native

          Ingress      : Disabled

HTH,

Lei Tian

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (2 ratings)
Loading.
Correct Answer
Lei Tian Wed, 08/14/2013 - 19:33
User Badges:
  • Cisco Employee,

Hi,


works on my 3560. Maybe some code issue.


CORE-SW1#sh ver | i IOS    

Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1)

CORE-SW1#sh monitor session all

Session 1

---------

Type                   : Local Session

Source Ports           :

    Both               : Fa0/1-20

Destination Ports      : Fa0/21

    Encapsulation      : Native

          Ingress      : Disabled

HTH,

Lei Tian

David Jennings Wed, 08/14/2013 - 19:37
User Badges:

Thanks. Should the ingress be disabled? Trying to capture packets in/out of those interfaces.


Sent from Cisco Technical Support Android App

Correct Answer
devils_advocate Thu, 08/15/2013 - 01:33
User Badges:
  • Gold, 750 points or more
  • Community Spotlight Award,

    Small Business, November 2015

Ingress in Lei's example above relates to the destination port, i.e ensures the destination port can only recieve packets and not transmit them so thats perfectly normal.

paul driver Thu, 08/15/2013 - 03:23
User Badges:
  • Green, 3000 points or more

Hello,

For a normal span session - the answer YES the ingress function should be disabled.


You enable ingress forwarding to accept traffic into that port say to allow for a device like a IDS/IPS to analyse the mirrored traffic.



res


Paul


Please don't forget to rate any posts that have been helpful.


Thanks.

Actions

This Discussion