SPAN session and wireshark feature

[umeshunited]

Hi,

I have used 2 local SPAN sessions available on 6513. Can I use inbuilt wireshark feature (monitor capture) to capture traffic?

[Dennis Mink]

 not sure what you mean by built in wireshark. but yes you can span a port and hookup a wireshark endpoint on the span destination and capture traffic that way.

[umeshunited]

Hi Dennis,

I have configured two local SPAN session on cisco 6513, using " monitor session " command.

Now as I have reached max no of sessions, I cannot use another " monitor session" command.

Cisco switches have embedded packet capture facility using " monitor capture" command,

by which we can capture packets to local buffer or remote tftp/ftp servers. Can I use that embedded packet capture to capture packets, as I have already consumed two local SPAN sessions ? Will it work ?