Re: Catalyst 3550 - Port monitoring (SPAN)

dave.hayhurst · ‎10-03-2003

Is it possible to monitor multiple Gigabit source ports to a single Gigabit destination port set to 100Mbps half duplex (required for intrusion detection box). The last attempt resulted in the switch crashing. Am I asking too much from the switch? Any advise would be apprecisted.

sirpa_k · ‎10-11-2003

This is not possible, I think.

boumard · ‎10-13-2003

IMHO, there is no problem, as long as the monitored traffic fits in the SPAN output port.

When traffic is too high, the switch is not supposed to crash but to drop frames on the ouput (monitoring) port. Standard QoS rules should apply.

I did test the SPAN feature on Catalyst 3550 switches. However, I did not test such an overload of the outgoing monitoring port. So, I can't be sure.

pleitnes · ‎10-13-2003

I have done exactly this (GigE squeezed into 100M) on 3550's in the past and it worked fine for me.

Did you get anything useful out of the switch that you could look up using any of the TAC tools (stack/error decoder etc)?

s.

dave.hayhurst · ‎10-14-2003

Thanks for the advice. I have now managed to mirror two Gigabit ports to a single Gigabit port running at 100Mbps Half duplex this should give me the info required. When the original config was installed I asked for 10 Gigabit ports to be mirrored to the same single port which caused the switch to fall over. Due to the switch being on a live network I did not have time to diagnose only reload the switch back to its original config - quickly !!.