Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

SPAN on Multiple Ports

On a 3560 or 3750 is it possible to SPAN multiple ports in 1 session to 1 destination port, with both tx and rx packets?  So this:

#monitor session 4 source int f0/2 - 10 both

monitor session 4 dest   int f0/11

I'm able to enter the commands, but when I do a "sh monitor 4"  it says that ingress is disabled.

2 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

SPAN on Multiple Ports

Hi,

works on my 3560. Maybe some code issue.

CORE-SW1#sh ver | i IOS    

Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1)

CORE-SW1#sh monitor session all

Session 1

---------

Type                   : Local Session

Source Ports           :

    Both               : Fa0/1-20

Destination Ports      : Fa0/21

    Encapsulation      : Native

          Ingress      : Disabled

HTH,

Lei Tian

SPAN on Multiple Ports

Ingress in Lei's example above relates to the destination port, i.e ensures the destination port can only recieve packets and not transmit them so thats perfectly normal.

5 REPLIES
Cisco Employee

SPAN on Multiple Ports

Hi,

works on my 3560. Maybe some code issue.

CORE-SW1#sh ver | i IOS    

Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, RELEASE SOFTWARE (fc1)

CORE-SW1#sh monitor session all

Session 1

---------

Type                   : Local Session

Source Ports           :

    Both               : Fa0/1-20

Destination Ports      : Fa0/21

    Encapsulation      : Native

          Ingress      : Disabled

HTH,

Lei Tian

Community Member

Re:SPAN on Multiple Ports

Thanks. Should the ingress be disabled? Trying to capture packets in/out of those interfaces.


Sent from Cisco Technical Support Android App

SPAN on Multiple Ports

Ingress in Lei's example above relates to the destination port, i.e ensures the destination port can only recieve packets and not transmit them so thats perfectly normal.

VIP Purple

Re: SPAN on Multiple Ports

Hello,

For a normal span session - the answer YES the ingress function should be disabled.

You enable ingress forwarding to accept traffic into that port say to allow for a device like a IDS/IPS to analyse the mirrored traffic.

res

Paul

Please don't forget to rate any posts that have been helpful.

Thanks.

Please don't forget to rate any posts that have been helpful. Thanks.
Community Member

SPAN on Multiple Ports

Thanks for the clarification.

288
Views
0
Helpful
5
Replies
CreatePlease to create content