cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
786
Views
0
Helpful
1
Replies

Monitoring interface traffic

CSCO11629535
Level 1
Level 1

I'm using a solution to monitor the traffic passing through the interface
SWCORE connecting with my router.
The Linux machine (sniff) has two interfaces (eth0 and eth1)
Etho (manages the machine) connected to the interface to another interface g1/18
(Sniff) connected in g1/27.

Add the following command:

monitor session 2 source interface Gi1/48
monitor session 2 destination interface Gi1/27

But I don't capture nothing.

I show monitor out following:

Session 2
---------
Type : Local Session
Source Ports :
Both : Gi1/48
Destination Ports : Gi1/27
Encapsulation : Native
Ingress : Disabled
Learning : Disabled

Do what doing wrong? Help me??

1 Reply 1

Michel Hegeraat
Level 7
Level 7

try this  "monitor session 2 source interface Gi1/48 ?"

Doesn't if show an option to span ingoing, outgoing or both traffic directions?

I think you need both

Do you see traffic on the spanport Gi1/27 if you do a  "show interface Gi1/27"  ?

The counters should go up

The interface Eth0 should be in promiscuous mode to capture the traffic other then for its own mac address or broad/multicast

Cheers,

Michel

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: