topic VLAN-Based SPAN in Network Security

VLAN-Based SPAN

n.steffen — Sun, 10 Mar 2019 10:00:55 GMT

hello everybody,

why can i only monitoring received (rx) traffic on a VLAN ?

thanks for an answer...

Re: VLAN-Based SPAN

a.giorgi — Sat, 13 May 2006 19:26:02 GMT

What do you mean?

Are you talking about SPAN (mirrored) port?

Please explain a little more.

What Catalyst model are you using?

Alberto Giorgi from spain

Re: VLAN-Based SPAN

a.giorgi — Sat, 13 May 2006 20:02:06 GMT

Hi again:

Ingress/Egress SPAN

In the example in the section Monitor VLANs with SPAN, traffic that enters and leaves the specified ports is monitored. The field Direction: transmit/receive shows this. The Catalyst 4500/4000, 5500/5000, and 6500/6000 series switches allow you to collect only egress (outbound) or only ingress (inbound) traffic on a particular port. Add the keyword rx (receive) or tx (transmit) to the end of the command. The default value is both (tx and rx).

set span source_port destination_port [rx | tx | both]

Have you defined only rx keyword?

I hope this help. Please rate if it does.

Best regards

Alberto Giorgi from spain.

Re: VLAN-Based SPAN

n.steffen — Sat, 13 May 2006 20:09:37 GMT

hi alberto,

yes, i will monitoring all the traffic on the vlan (vlan based span). the plattform is 3550-12G switch. what can i do for monitorig all the traffic in our campus lan?i can take only one port (physical) for source traffic monitoring rx and tx (both), so i have 12 ports for monitorig...what can i do, i dont find a solution!

nik

Re: VLAN-Based SPAN

n.steffen — Sat, 13 May 2006 20:59:39 GMT

hi,

yes, in the configuration for vlan monitoring i can only monitor rx traffic, why again?. an other solution is monitoring the source gigabitinterfaces...on this way i can only 1 interface take for rx and tx (both) monitoring, but i have 8 gigabitinterface for monitoring...the cisco 3550-12G plattform dosent support more sourceports.