Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Purple

span

I think the answer is no , but is there anyway to setup a span session to a local pc with sniffer software on it and still be able to get to that pc via the network ? I believe span disables any outgoing traffic . I believe this will be a manual deal but just wanted to run this by everyone.

1 REPLY

Re: span

I would concur with your opinion.

The answer probably lies in the fact that the sniffer is connected to a SPAN "Destination" interface.

Although I typically unbind the IP stack from the NIC used for Wireshark packet capture, I did the following a few minutes ago:

Note: My SPAN source interface is the trunk port used for inter-VLAN routing.

I configured the sniffer NIC with a static IP, then tried to ping a host on another network to verify that the sniffer NIC could place packets on the wire, and that my IP was what I expected.

I saw the sniffer NIC try to ARP its default gateway, but the gateway did not respond.

Then I tried to ping the sniffer NIC from a host on another network. I saw the local gateway ARP my sniffer NIC, but the NIC did not respond.

107
Views
0
Helpful
1
Replies