Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.



I think the answer is no , but is there anyway to setup a span session to a local pc with sniffer software on it and still be able to get to that pc via the network ? I believe span disables any outgoing traffic . I believe this will be a manual deal but just wanted to run this by everyone.


Re: span

I would concur with your opinion.

The answer probably lies in the fact that the sniffer is connected to a SPAN "Destination" interface.

Although I typically unbind the IP stack from the NIC used for Wireshark packet capture, I did the following a few minutes ago:

Note: My SPAN source interface is the trunk port used for inter-VLAN routing.

I configured the sniffer NIC with a static IP, then tried to ping a host on another network to verify that the sniffer NIC could place packets on the wire, and that my IP was what I expected.

I saw the sniffer NIC try to ARP its default gateway, but the gateway did not respond.

Then I tried to ping the sniffer NIC from a host on another network. I saw the local gateway ARP my sniffer NIC, but the NIC did not respond.