Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

SPAN session tx or rx question

When configuring a SPAN session for a single direction on core 6509:

monitor session 1 source vlan 1, 5 , 7, 9 rx

Monitor session 1 destination interface g1/1

VLAN 5 is uplink to Firrewall/Internet

VLAN 7 is workstation VLAN

If a workstation is attempting to connect to an FTP server on the Internet, would I see any traffic on VLAN 5 in the rx direction?

Or does the SPAN session only see traffic sourced from the FTP server?

It the traffic is outbound to the FTP server, would there be any rx traffic inbound  on the VLAN 5 port?

3 REPLIES
Hall of Fame Super Bronze

Re: SPAN session tx or rx question

If a workstation is attempting to connect to an FTP server on the Internet, would I see any traffic on VLAN 5 in the rx direction?

No, you will see traffic on Vlan 7 on the rx

Or does the SPAN session only see traffic sourced from the FTP server?

Vlan 5 (internet Vlan) will capture all received traffic from the internet so return traffic from the FTP server will be captured.

New Member

Re: SPAN session tx or rx question

Thanks Edison, that is what I suspected.

But I was wondering (and I hope this is not a stupid question)

There will always be some return traffic from the Internet that gets captured rx on the VLAN 5 port, no matter who initiates the connection?

Since this is tcp, there will always be return traffic seen on the rx on SPAN 1 VLAN 5 from the Internet, correct?

Re: SPAN session tx or rx question

Yes you are rite you can see the traffic coming back from ftp server for ACK to source in internet facing vlan
and traffic which is initiated to ftp server from host from host vlan also.

Regards
Ganesh.H

278
Views
10
Helpful
3
Replies