No TCP traffic showing in a SPAN Session

[smezache]

Hi,

I was wondering if disabling vlan 1 on a switch does not forward all traffic from a SPAN source interface to the destination interface. For security reason, I shutdown the vlan 1 interface (as it was not needed), but when I want to monitor the traffic going through an interface on the switch it only passes the UDP, CDP, and other types of traffic but none of the TCP traffic is showing up on the destination interface. Both, RX and TX are configured on the source interface and everything else looks good as far as the session configuration. I am monitoring the traffic of a router on a 2900 series switch with a 12.1 IOS.

Please let me know if having vlan 1 turned off could be causing the problem or not.

Thanks

[Richard Burts]

Samy

I would be very surprised if shutting down the VLAN 1 interface would produce the symptoms that you describe.

Are you seeing unicast UDP traffic or just broadcast and multicast? In my experience most symptoms such as you describe are a result of not having SPAN (or port monitor depending on the switch model) configured correctly. Seeing multicast and broadcast but not unicast would help confirm this.

HTH

Rick

[smezache]

Thanks for the reply and I hear what you are saying. To answer your question, yes. . . The traffic is multicast and broadcast and multicast in nature. Here is the configuration I entered in the switch (all ports are on the same switch):

monitor session 1 source interface fa0/1 both

monitor session 1 destination interface fa0/2

beside the above command lines, I am not sure what can be done to configure the SPAN!

[Richard Burts]

Samy

I do not see a problem in what you posted. Could you post the output of show interface for ports fa0/1 and fa 0/2? Also the output of show monitor (or equivalent command depending on model of switch).

HTH

Rick

[amit-singh]

Hi Samy,

Please paste the output of " Show vlan " and also the running config from your switch.

regards,

-amit singh