Is there a way to switch a 5509 to store and forward mode, so when I span a port I can see the errors come in on a port? I have a remote sniffer attached to the switch to save me from going to the remote location. But I can't see the errors comming from the hub because the switch kills those packets. The counters on the port are nice but are not much help to identify who doing what. You can change the mode on a 3200 but I see no command to change it on a 5505. Thoughts/ideas anyone?
Thanks for the info but I still see no errors on the sniffer. Though the counter on the switch sees them. Of course if the errors occur before the first 2 bytes of the destination mac, the sniffer wont see it. I'll keep
You may need a Tap instead of a span port. lebrasseur is correct. A span port must be set up properly first, however span ports DO NOT see all traffic because the switch will drop packets that are too short or other types of errors.
Specifically, read the paragraph here from that pdf->
"...In contrast, a monitoring device connected to a SPAN port on a switch does not see all traffic. Corrupt network packets, or packets below minimum size, are usually dropped by the ingress ports on a switch; corrupt packets visible to the monitoring device are usually generated within the egress segment. In addition, switches eliminates layer 1 and select layer 2 errors. Without this information, it is impossible to properly troubleshoot common physical layer problems such as bad frames generated by a faulty NIC.
Thanks for the info. After I submited the question I thought "hey stupid, it is in store and forward. I need it to be in cut through. DUHHHHH. Normally I would just take the portable sniffer out and attach it to the hub. In this case somebody "hijacked the closet" and we have to search far and wide to get somebody to open the door. Well if it was easy anybody could do it. Thanks again for the info
Hi everyone, I would like to thank you in advance for any help you can provide a newcomer like myself!
Im studying the 100-105 book by Odom and am currently on the topic of Port security. I purchased a used 2960 and I'm trying to follow a...
While deploying a number of 18xx/2802/3802 model access points (APs), which run AP-COS as their operating platform. It can be observed on some occasions that while many of their access points were able to join the fabric WLC withou...
I am going to design and build an LAN network under a tunnel underground with long distance between the switches.
I will have 2 Catalyst switches and 8 Industrial IE3000, and they will be connected with fiber.
For now I am planning on use Layer-2 s...