SPAN is only one way

[ansonch]

I've set up SPAN on my Cisco 2950 Switch to analyze network traffic. I've mirrored all traffic going to the switch source (FastEthernet 0/1) to destination

(FastEthernet 0/13)

The problem is that the sniffer I have on FastEthernet 0/13 needs to have the ability to email out. Plus, I need the ability to remote access into the server behind FastEthernet0/13 to manage the sniffer program.

How can this be done? Am I using the correct feature (SPAN)?

Much thanks,

Anson

(docs I was refering to)

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12114ea1/2950scg/swspan.htm

[Prashanth Krishnappa]

From the document you pointed to...

"

The port does not transmit any traffic except that required for the SPAN session."

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat2950/12114ea1/2950scg/swspan.htm#1036749

[ansonch]

Is there any other way to set the switch so that it will allow me to have the server to have remote access ability?

[t.baranski]

Not with current IOS versions. It is hoped that this will be fixed in the future.

In the meantime, you can add a second NIC to the machine, transfer the IP address to it (the sniffing interface doesn't need one), and attach it to a normal switch port.