Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

Cannot sniff traffic spanned on a 2950

Pardon me if this has been asked and answered, but I did look around and I did not see it.

I have set up a monitor session on a 2950 but I cannot see the traffic. The applications I am using, windump and ethereal on win2k, are vlan aware, but using "vlan" as an expression in windump or as a filter in ethereal does not work.

If I omit the vlan filter, I see stuff like bpdus and cdp stuff. When I apply the filter, I see nothing at all. In windump I use a command like like:

windump -i 3 vlan


windump -e -i 3 vlan

I am using the latest and greatest winpcap, windump, ethereal, etc. I also know that I could probably use a real sniffer, but I kind of hate to ask my boss to spend $20,000 just because a freebie doesn't want to work for me. (I'd rather ask him to spend $20,000 based on what the real sniffer can do that the freebie can't! ;-) )


Re: Cannot sniff traffic spanned on a 2950

Possilby if you included your monitor configuration in your request we could help you more. The products you are trying to use should work for you fine but if your monitor is setup incorrectly you will see nothing.

Hope this helps,


New Member

Re: Cannot sniff traffic spanned on a 2950

Here's my monitor config:

monitor session 1 source interface Fa0/2

monitor session 1 destination interface Fa0/3

The first command was entered with "both" at the end, but it doesn't show up in the config. The IOS is version 12.1(9)EA1 enhanced image for the 2950.



Cisco Employee

Re: Cannot sniff traffic spanned on a 2950

Try ethereal. It's a great free sniffer software which can be downloaded from the web at

SPAN capablilities are pretty basic in a 2950 and more info can be found on CCO at

New Member

Re: Cannot sniff traffic spanned on a 2950

Actually, I started with Ethereal, and switched to windump because both ride on wincap and I find it easier to troubleshoot a command line app because the GUI just gets in the way if things are not working. Thanks for the note, though.

CreatePlease to create content