Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

SPAN sessions

I'm running into a problem with the span session limits on the 6500's...right now we have two 6500's connected to each other with Layer 2 ether channel trunks, and both use monitor session 1 for the IDS. I use monitor session 2 for general trouble shooting when I need to...however now I have the need to add a 3rd and 4th session (for a net management tool and a filter)...how can I go about doing this with a 2 session limit?

Should I think about adding another switch (a 3750 or something like that) and just have a few RSPAN sessions on the 6500's sending traffic over to the 3750, and set up all the management tools as well as the IDS on there?

4 REPLIES
New Member

Re: SPAN sessions

shameless bump...any help would really be appreciated.

New Member

Re: SPAN sessions

In a similar situation , I have replicated the span session with a network tap device. You only use one span session , but the tap device replicates this session within its ports.

There are many suppliers for this device , you can choose one of them.

Hope to help,

Kerem

Cisco Employee

Re: SPAN sessions

Virtual SPAN may be able to help here.

You can set up a single source SPAN with multiple destination trunk ports. As of 12.2(18)SXD, you can filter each destination trunk port by vlan. See the attached pdf for more information.

HTH

New Member

Re: SPAN sessions

I like both ideas...I want to give the virtual span session a try before getting another device.

I have a question about Virtual SPAN though, you can filter vlans to the destination port to only allow traffic captured on that vlan source...what if the source is an interface or multiple interfaces?

256
Views
0
Helpful
4
Replies
CreatePlease to create content