07-30-2009 04:51 PM - edited 03-06-2019 07:01 AM
I have two switches. One core switch and another access switch which both I am trying to monitor the traffic using the following statements.
Core sw __Gi1/0/5_ Access switch
|_________Gi1/0/3_ Monitoring console
|_________Gi1/0/1_ PC
! On the core switch
monitor session 1 source remote vlan 999
monitor session 1 destination interface Gi1/0/3
monitor session 2 source interface Gi1/0/1 rx
monitor session 2 destination remote vlan 999
I can monitor the access switch, the problem is that Gi1/0/1 which is local to the core switch gives me nothing when I monitor it.
! This 2 statements doesn't seem to work for me.
monitor session 2 source interface Gi1/0/1 rx
monitor session 2 destination remote vlan 999
Any help would be appreciated.
07-31-2009 12:46 AM
Hello Mun,
it is unclear what you are trying to do.
vlan 999 is a remote span vlan and allows you to capture traffic on access layer switch to carry it inside vlan 999 over a trunk port to core switch and to deliver it on port g1/0/3.
then you have a second session with source g1/0/1.
if you want to have on g1/0/3 traffic from both vlan999 and port g1/0/1 you should try:
use a single monitor session with two sources and one destination
In other words if you put traffic on vlan999 you are sending it to access layer switch not to port g1/0/3.
I understand you think access switch could reflect it to core switch but this is not happening I guess.
Hope to help
Giuseppe
07-31-2009 03:01 AM
Hi Giuseppe,
Thanks for explaining the concept for the 2nd session.
What you mentioned is what my intentions are. The problem is I am using Cisco 3750 and "use a single monitor session with two sources and one destination" is not allowing me to do that. I can have only 1 of the source running on switch.
Regards,
Alan
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide