Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

SPAN on Cat2950, ports in trunk mode, vlan 1&2, data&voip

I am trying to troubleshoot static on VOIP phones (sorry, Nortel phone sets, I know, I should have chosen Cisco). We have a Nortel BCM 400. It has two ethernet connections: one for management, one for voice traffic. The voice trafffic line is plugged into port fa0/46 on a Cisco 2950. That port is in vlan 2. All other fast ethernet ports are in trunking mode. The management interface (vlan1) is the data vlan. 192.168.11.0/24 is data. The BCM is the dchp server for the phones, it hands out IP addresses in this range to the phones: 10.11.250.0/24. At a typical desk, the VOIP phones are plugged into the datajack and then the computers are plugged into the phone. I want to capture the traffic for one phone set. That is, capture all the traffic between one phone set and the BCM. Of course, I don't want to see vlan 1 traffic, just vlan 2(voip) traffic.

Let's say fa0/5 is free and I can plug my laptop into that port and run Wireshark on the laptop. fa0/6 is the port that the phone is connected into. Will the following config work?

int fa0/5

port monitor fa0/46

port monitor fa0/6

I know that you cannot span a port if the source and destination are in different vlans, but what about a trunk port?

port fa0/5 (the destination port) is in trunk mode. The first monitored port, fa0/46, is in vlan 2, and the second monitored port, fa0/6, is in trunk mode.

1 REPLY
Cisco Employee

Re: SPAN on Cat2950, ports in trunk mode, vlan 1&2, data&voip

The destination port should not be a trunk port. For safety reasons, it should be a transmit-only (i.e. ingress traffic should be disabled) port that you use for a probe (or in this case a laptop running Wireshark).

But, the following should work:

monitor session 1 source interface Fa0/6 , Fa0/46

monitor session 1 destination interface Fa0/5

146
Views
0
Helpful
1
Replies
CreatePlease to create content