Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

How to get more than two monitor sessions on 3750G

We are deploying several (6) IDS sensors to monitor traffic on various VLANs on the core router/switch 3750Gs. I can only do two SPAN monitor sessions. Is there a workaround with SPAN or RSPAN so I can mirror/capture traffic for the many IDS sensors? Thanks.

  • LAN Switching and Routing
4 REPLIES

Re: How to get more than two monitor sessions on 3750G

Physical taps can help. Google 'network tap' for mfg's.

HTH and please rate.

New Member

Re: How to get more than two monitor sessions on 3750G

Yes, I thought about physical taps for the router links. But as for the many VLANs that live on the core router, I won't be able to tap in. Anyway around it?

Re: How to get more than two monitor sessions on 3750G

I would think that their higher-end products you would be able to trunk multiple VLANS to a single TAP. We span multiple source VLANs to a single destination port for IDS.

CORE1#sh mon

Session 1

---------

Type : Local Session

Source VLANs :

Both : 26,30,104,300,603

Destination Ports : Gi7/1

New Member

Re: How to get more than two monitor sessions on 3750G

The 3750Gs can do multiple source and multiple destinations, but only 2 sessions. Thus I can only do a source-destination pair session only twice. I may just have to SPAN many VLANs and ports, and then have the IDS sensors filter out the unwanted traffic as needed. I'm trying to see if RSPAN can overcome this limitation. Keep the ideas flowing. Thanks.

280
Views
0
Helpful
4
Replies
This widget could not be displayed.