Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Configuring SPAN port for Websense

I saw similar posts but I am still lost and my configuration is a bit different.  I have configured a SPAN port on my Cisco 4510 switch, however I am not seeing the desired traffic in my Websense server.  I am verifying using Wireshark as suggested by Websense support, but I am seeing no results. 

Here is the show monitor for the session I created:

Session 4

---------

Type                   : Local Session

Source VLANs           :

    Both               : 1-252

Destination Ports      : Fa7/2

    Encapsulation      : Native

          Ingress      : Enabled, default VLAN = 1

         Learning : Disabled

Filter Pkt Type        :

    RX Only       : Good

We have a lot of VLANs and I am trying to monitor almost all of them to see what type of bandwidth is being used.

Suggestion from Websense support:

You can run Wireshark against the NIC you're port spanning to and use the filter:

http contains purple.com

Each time you feel you may have configured your port span correctly, go to purple.com from a workstation that should be passing through the configured port span. You should see a GET request packet appear in WIreshark if your port span is correctly configured.

Everyone's tags (4)
3 REPLIES
Silver

Re: Configuring SPAN port for Websense

Hi Paul,

In this case, I see that you are sending traffic from vlans 1-252 to a fast ethernet port. Do you see any drops on that interface? It just because I would say that the amount of traffic is too much for a Fastethernet port which may cause congestion and output drops. Therefore you might not see all traffic as desire.

Hope this helps.

Re: Configuring SPAN port for Websense

Paul,

Can you post "sh run | i monitor"?

HTH,

John

HTH, John *** Please rate all useful posts ***
New Member

Re: Configuring SPAN port for Websense

Here is how I have my port configured at the moment:

---

interface FastEthernet7/2

switchport mode access

end

---

monitor session 4 source vlan 1 - 252

monitor session 4 filter packet-type good rx

monitor session 4 destination interface Fa7/2 ingress vlan 1

---

Session 4

---------

Type                   : Local Session

Source VLANs           :

    Both               : 1-252

Destination Ports      : Fa7/2

    Encapsulation      : Native

          Ingress      : Enabled, default VLAN = 1

         Learning : Disabled

Filter Pkt Type        :

    RX Only       : Good

---

730
Views
0
Helpful
3
Replies
CreatePlease to create content