×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Monitor Session on Cat6500 running IOS

Unanswered Question
May 4th, 2006
User Badges:

I have a pair of Cat6500s. There is a server with two NICs and each one of the NICS is connected to a gigabit port on each of the Cat6500s. I want to be able to sniff the two ports by monitoring both ports from a single destination port on one of the Cat6500s. How do I do this?


Any help is greatly appreciated?


Thank You

Sean Boston

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
eward15 Thu, 05/04/2006 - 12:09
User Badges:

RSPAN.


Check out this link:


http://www.cisco.com/univercd/cc/td/doc/product/core/cis7600/software/122sx/swcg/span.htm#wp1059942


The 6500 IOS is similar to the 7600 IOS in native mode (you are referring to Native mode, aren't you? :^) ).


Basically, on the one 6500 that you are sniffing from, your config would look like this:



vlan 500

remote-span


monitor session 1 source int (server's int #1)

monitor session 1 source remote vlan 500

monitor session 1 destination (sniffer int)


On the other 6500:


vlan 500

remote-span


monitor session 1 source int (server's int #2)

monitor session 1 destination remote vlan 500


I just picked 500 for the example. Don't forget to allow the remote vlan across your trunk link, preferably (if you are expecting a lot a traffic), across a trunk link that does not have a lot of traffic across it.


Hope this helps.


Eugene

Actions

This Discussion