topic Re: SPAN session and wireshark feature in Network Security

SPAN session and wireshark feature

umeshunited — Fri, 21 Feb 2020 15:38:35 GMT

Hi,

I have used 2 local SPAN sessions available on 6513. Can I use inbuilt wireshark feature (monitor capture) to capture traffic?

Re: SPAN session and wireshark feature

Dennis Mink — Wed, 18 Apr 2018 02:22:43 GMT

not sure what you mean by built in wireshark. but yes you can span a port and hookup a wireshark endpoint on the span destination and capture traffic that way.

Re: SPAN session and wireshark feature

umeshunited — Wed, 18 Apr 2018 04:31:36 GMT

Hi Dennis,

I have configured two local SPAN session on cisco 6513, using " monitor session " command.

Now as I have reached max no of sessions, I cannot use another " monitor session" command.

Cisco switches have embedded packet capture facility using " monitor capture" command,

by which we can capture packets to local buffer or remote tftp/ftp servers. Can I use that embedded packet capture to capture packets, as I have already consumed two local SPAN sessions ? Will it work ?