How to capture packets in a particular interface of a switch

[Mohammed Aswath Ali]

Hello everybody,

       we are using NAM traffic analyzer 4.0 in our network . i want to capture packets flowing in and out of a particular interface of switch.

Is it possible ? 

[Vinod Arya]

Yes this is possible. You can use Switched Port Analyzer (SPAN) feature to do so. The Switched Port Analyzer (SPAN) feature, which is sometimes called port mirroring or port monitoring, selects network traffic for analysis by a network analyzer.

With SPAN you can capture both :

Ingress traffic—Traffic that enters the switch.

Egress traffic—Traffic that leaves the switch.

A basic example of configuring SPAN is :

Switch(config)# monitor session 1

Switch(config)# monitor session 1 source interface fastEthernet0/1

Switch(config)# monitor session 1 destination interface fastEthernet0/10 encapsulation dot1q

Switch(config)# end

For more details check these docs :

https://supportforums.cisco.com/docs/DOC-2632

http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/span.html#wp1020334

-Thanks

Vinod
**Rating Encourages contributors, and its really free. **