Monitor session in portchannel

[gkirubananthan]

Hi Guys,

i need to monitor any traffic flowing thru the trunks between two switches ( port- channel configured) .  Do i want to use "encapsulation replicate" with monitor destination

monitor sess 1 source po 1 both

monitor sess 1 destination int fa 0/1 encapsulation replicate

or with out

monitor sess 1 source po 1 both

monitor sess 1 destination int fa 0/1

Please advice.

Thanks

[Talha Ansari]

Hi,

If you want to do packet capture then below command is enough.

monitor session 1 destination int fa 0/1

In the portchannel you must be having multiple fastethernet port bundled and the traffic may or may not be more than 100 mbps. The destination port is only 100 mbps fastethernet port. Hence, if you connect a machine there you may face output packet drops on the destination port and not all packets would be captured.

Regards,

Talha

[ranraju]

Hi,

I would agree to Talha "monitor session 1 destination int fa 0/1" would be sufficient. But if you have encapsulation replicate, you can capture the tagged packets in the SPAN session and see it on the destination port. Since you are sniffing a trunk port, I think you would need "encapsulation replicate" in your SPAN destination configuration.

Regards,

ranraju

[gkirubananthan]

Thanks. for the reply.

when i tried to configure RSPAN & SPAN as source in same monitor  session,  i get below error. is that mean we cannot configure SPAN &  RSPAN as source in same monitor session

"% Cannot add RSPAN VLAN as source for SPAN session 1 as it is not a RSPAN Destination session     "

my intention is to replicate all  the vlan 61 & 73 receiving packet in both switches to snifer connected to DAS-SW4 fa 0/12

configuration as below

DAS-switch1

-----

vlan 101

remote-span

monitor sess 1 source vlan 61 73 rx

monitor sess 1 destination remote vlan 101

DAS-SW4

---------

vlan 101

remote-span

DAS-SW4#monitor session 1 source vlan 61 ,73 rx

DAS-SW4(config)#monitor session 1 source vlan 61 ,73 rx

DAS-SW4(config)#monitor session 1 source remote vlan 101

% Cannot add RSPAN VLAN as source for SPAN session 1 as it is not a RSPAN Destination session      

DAS-SW4(config)#monitor session 1 destination interface Fa0/12