Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

configuring Span port on 6513 switch

Hi,

I have two servers, connected on two(Different) 6513 directly connected switches.

Both these servers are in the same Vlan.

I have to monitor communication these two servers.

I have a system connected on one of the 6513 switch, where network tool wireshark is installed.

Need help to configure span port.

switch 6513-1# show run int Gi10/43  --------------------Server 1 is connected

switch 6513-2# show run int Gi9/45 ------------------------Server 2 is connected

switch 6513-2# show run int Gi9/46 ------------------------System on which network tool wireshark is installed.

  • LAN Switching and Routing
1 ACCEPTED SOLUTION

Accepted Solutions

configuring Span port on 6513 switch

You wouldn't need to modify the port that the servers are on. You create a vlan for span traffic only. Something like the following:

Switch A:

vlan 999

remote-span

monitor session 1 sourc int g 4/5

monitor session 1 destin remote vlan 999

Switch B:

vlan 999

remote-span

monitor session 1 source remote vlan 999

monitor session 1 destin int g 4/24

You would connect your Wireshark box/analyzer to port g4/24 on Switch B. Traffic that's sent on Switch A on port 4/5 (assuming where your server is) will get copied to the vlan. Make sure that your vlan 999 is on the trunk between the two switches.

John

Please rate all helpful posts.

HTH, John *** Please rate all useful posts ***
9 REPLIES
New Member

configuring Span port on 6513 switch

Some correction, wireshark is installed on server 2

New Member

configuring Span port on 6513 switch

Hi

you can monitor only server 1 because wireshark is installed on server 2

A SPAN destination port cannot be a source port, and a source port cannot be a destination port.

monitor session 1 source interface Gi10/43

monitor session 1 destination interface Gi9/45

http://www.cisco.com/en/US/docs/switches/lan/catalyst2940/software/release/12.1_19_ea1/configuration/guide/swspan.html#wp1078977

New Member

configuring Span port on 6513 switch

Got your point. I will get wireshark installed on another system, say, that system is connected on 6513-2 switch port number Gig9/46.

Again all these are in the same Vlan, that is Vlan 4.

switch 6513-1# show run int Gi10/43 --------------------Server 1 is connected

switch 6513-2# show run int Gi9/45 ------------------------Server 2 is connected

switch 6513-2# show run int Gi9/46 ------------------------System on which network tool wireshark is installed.

New Member

configuring Span port on 6513 switch

Again, if we have monitor server 1 which is connected on switch 6513-1 and wireshark is installed on system which is connected on switch 6513-2.

I need to know the configuration for both these scenario.

New Member

configuring Span port on 6513 switch

Hi

If wireshark installed on another system, say, that system is connected on 6513-2 switch port number Gig9/46


switch 6513-1# show run int Gi10/43 --------------------Server 1 is connected

switch 6513-2# show run int Gi9/45 ------------------------Server 2 is connected

switch 6513-2# show run int Gi9/46 ------------------------System on which network tool wireshark

monitor session 1 source interface Gi10/43

monitor session 1 source interface Gi10/45

monitor session 1 destination interface Gi9/46

New Member

configuring Span port on 6513 switch

In my case server 1 is connected on switch 6513-1 and server 2 is connected on switch 6513-2.

Again system on which wireshark is installed is also connected on switch 6513-2.

Queston.

What commands need to be enabled on switch 6513-1

and what command need to enabled on switch 6513-2

All these devices are in the same Vlan.

configuring Span port on 6513 switch

Because these 2 hosts are on 2 separate switches, you're probably going to need to set up an RSPAN session. You'll create a special remote span vlan and add that to your trunk between the 2 switches. Then the switch that you set up as a source, its destination is the vlan that you created and on the destination switch, its source is the RSPAN vlan.

Check here:

http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/swspan.html#wp1081130

HTH, John *** Please rate all useful posts ***
New Member

configuring Span port on 6513 switch

As you mention adding special remote span vlan to the trunk.

Do I need to add this vlan to the switch interfaces to which these servers are connected.

These servers are already in Vlan 4.

configuring Span port on 6513 switch

You wouldn't need to modify the port that the servers are on. You create a vlan for span traffic only. Something like the following:

Switch A:

vlan 999

remote-span

monitor session 1 sourc int g 4/5

monitor session 1 destin remote vlan 999

Switch B:

vlan 999

remote-span

monitor session 1 source remote vlan 999

monitor session 1 destin int g 4/24

You would connect your Wireshark box/analyzer to port g4/24 on Switch B. Traffic that's sent on Switch A on port 4/5 (assuming where your server is) will get copied to the vlan. Make sure that your vlan 999 is on the trunk between the two switches.

John

Please rate all helpful posts.

HTH, John *** Please rate all useful posts ***
1851
Views
0
Helpful
9
Replies