Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

port spanning entire networks

Hi there,

I have a question regarding port spanning. I have a 2900XL and a few 2950's, and I was wondering what effects spanning an entire swith to one monitoring port would be. How would you approach sniffing a network for a baseline? Should I monitor just the server ports and uplink ports?

Thanks!

7 REPLIES
Bronze

Re: port spanning entire networks

Port monitoring, if configured correctly, doesn't affect the performance of the switch or network.

First, clearly define what your reasons are for the monitoring, then I think you will be able to decide exactly what you should monitor.

Also please explain what you mean by "sniffing a network for a baseline" ?

New Member

Re: port spanning entire networks

Hi Skarundi,

Basically what I would be looking to do, over a period of a week or so, do random captures of the entire network to see what the load is across then LAN segment, and what devices chat to other devices most frequently. I would be using Sniffer to compliment the Catalyst Management Suite.

Bronze

Re: port spanning entire networks

You could span each vlan, one vlan at a time, on the core switch.

New Member

Re: port spanning entire networks

Hi Skarundi,

We only have one VLAN actually.

New Member

Re: port spanning entire networks

This "entire VLAN in a port" solution would work if the load of the entire network at any point in time is not excedding the bandwidth capacity of the destination port. If the aggregate bandwidth exceeds the SPANned destination port, it would drop the excess packets on the way to your collector device. Also, I think if the SPANning is on the same VLAN, you may see the packet twice on the destination port: one when the packet enters the source port and one more time when it it is sent to other port in the same VLAN. Check it out.

New Member

Re: port spanning entire networks

If you are capturing an entire VLAN to one port, you will most likely drop tons of packets and you will not be able to get an accurate idea of the load.

I think there are much better ways to baseline and monitor switch and network performance than to use a sniffer. I use Fluke's Network Inspector or Solarwinds tools, which are SNMP-based and pull stats from each device. Fluke also makes nice reports and charts.

New Member

Re: port spanning entire networks

Hi,

Have you looked at IOS command netflow?

R/S

Dave

100
Views
0
Helpful
7
Replies