cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
4643
Views
0
Helpful
5
Replies

SPAN on Multiple Ports

mumbles202
Level 5
Level 5

On a 3560 or 3750 is it possible to SPAN multiple ports in 1 session to 1 destination port, with both tx and rx packets?  So this:

#monitor session 4 source int f0/2 - 10 both

monitor session 4 dest   int f0/11

I'm able to enter the commands, but when I do a "sh monitor 4"  it says that ingress is disabled.

2 Accepted Solutions

Accepted Solutions

Lei Tian
Cisco Employee
Cisco Employee

Hi,

works on my 3560. Maybe some code issue.

CORE-SW1#sh ver | i IOS    

Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1)

CORE-SW1#sh monitor session all

Session 1

---------

Type                   : Local Session

Source Ports           :

    Both               : Fa0/1-20

Destination Ports      : Fa0/21

    Encapsulation      : Native

          Ingress      : Disabled

HTH,

Lei Tian

View solution in original post

Ingress in Lei's example above relates to the destination port, i.e ensures the destination port can only recieve packets and not transmit them so thats perfectly normal.

View solution in original post

5 Replies 5

Lei Tian
Cisco Employee
Cisco Employee

Hi,

works on my 3560. Maybe some code issue.

CORE-SW1#sh ver | i IOS    

Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1)

CORE-SW1#sh monitor session all

Session 1

---------

Type                   : Local Session

Source Ports           :

    Both               : Fa0/1-20

Destination Ports      : Fa0/21

    Encapsulation      : Native

          Ingress      : Disabled

HTH,

Lei Tian

mumbles202
Level 5
Level 5

Thanks. Should the ingress be disabled? Trying to capture packets in/out of those interfaces.


Sent from Cisco Technical Support Android App

Ingress in Lei's example above relates to the destination port, i.e ensures the destination port can only recieve packets and not transmit them so thats perfectly normal.

Hello,

For a normal span session - the answer YES the ingress function should be disabled.

You enable ingress forwarding to accept traffic into that port say to allow for a device like a IDS/IPS to analyse the mirrored traffic.

res

Paul

Please don't forget to rate any posts that have been helpful.

Thanks.


Please rate and mark as an accepted solution if you have found any of the information provided useful.
This then could assist others on these forums to find a valuable answer and broadens the community’s global network.

Kind Regards
Paul

Thanks for the clarification.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: