I have two trunk port over Metroethernet contains several VLAN. And Cisco 3550 is meeting point for 2 trunk. I wanna monitor those trunk (far sites) traffic.
I try several SPAN on cisco 3550 switch but i didn’t get a source-destination traffic .
Here is my configs and output. And you can see my topology in attachement:
Config I:
monitor session 1 source vlan 1 - 4094 rx
monitor session 1 destination interface Fa0/8
Output 1 (tcpdump -i eth1)
...
10:28:49.398386 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:69:48:6a.800a, length 43
10:28:49.403695 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:28:49.423092 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:b2:73:c0.800c, length 43
10:28:49.435660 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:28:49.467041 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:28:49.503562 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:28:49.511120 IP 172.16.1.46 > ospf-all.mcast.net: OSPFv2, Hello, length 60
10:28:49.512063 IP 172.16.2.46 > ospf-all.mcast.net: OSPFv2, Hello, length 60
...
##############################################
Config II:
monitor session 1 source vlan 1 - 4094 rx
monitor session 1 destination interface Fa0/8 encapsulation dot1q
Output II (tcpdump -i eth1)
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
##############################################
Config III:monitor session 1 source interface Fa0/20
monitor session 1 destination interface Fa0/8
Output III (tcpdump -i eth1)
...
10:43:59.148118 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:43:59.160031 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:07:5d:ff.8008, length 43
10:43:59.181057 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:07:5e:3b.8009, length 43
10:43:59.183669 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:43:59.188202 IP 172.16.1.114 > ospf-all.mcast.net: OSPFv2, Hello, length 56
10:43:59.219978 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:43:59.251886 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 1444
10:43:59.255620 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:43:59.258862 IP 172.16.1.181 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 64
10:43:59.264209 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:f3:63:75.800e, length 43
10:43:59.267031 IP 172.16.1.185 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 84
10:43:59.285143 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:3a:65:4a.800e, length 43
10:43:59.290841 IP 172.16.2.182 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 84
...
##############################################
Config IV:
monitor session 1 source interface Fa0/20
monitor session 1 destination interface Fa0/8 encapsulation dot1q
Output IV (tcpdump -i eth1)
...
10:45:54.508798 STP 802.1d, Topology Change
10:45:56.508461 STP 802.1d, Topology Change
10:45:58.508160 STP 802.1d, Topology Change
10:45:58.748225 DTPv1, length 38
10:46:00.508760 STP 802.1d, Topology Change
10:46:02.508853 STP 802.1d, Topology Change
10:46:04.508826 STP 802.1d, Topology Change
...
##############################################
Config V:
monitor session 1 source interface Fa0/20 - 21 rx
monitor session 1 destination interface Fa0/8
Output V (tcpdump -i eth1)
...
10:50:14.464530 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:e3:48:b6.800c, length 43
10:50:14.473268 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.481147 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:cd:64:22.8008, length 43
10:50:14.484894 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:e3:48:da.800b, length 43
10:50:14.491750 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:cd:63:e5.8009, length 43
10:50:14.500191 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:32:8c:52.800e, length 43
10:50:14.505504 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.541735 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.549495 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Ack, length 1444
10:50:14.577783 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.600906 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:32:8c:4a.800d, length 43
10:50:14.613448 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.649487 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.684209 IP 172.16.1.198 > ospf-all.mcast.net: OSPFv2, Hello, length 60
10:50:14.685534 IP 172.16.2.154 > ospf-all.mcast.net: OSPFv2, LS-Update, length 60
10:50:14.704529 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:04:62:cd.800e, length 43
10:50:14.706505 STP 802.1d, Config, Flags [none], bridge-id 8000.00:00:0c:04:62:d9.800f, length 43
...
I can't see hsot interactions. Why?
And How do you solve this problem?
