Monitoring the traffic

[rakeshsharma3000]

I have a non cisco switch, on which I am mirroring the traffic from port 24 to port 23. Port 24 is the source and port 23 is the destination. I have checked by connecting sniffer to this port and it is working fine. Now starts the funny part. One of my client has a 6500 with NAM module and he wants to monitor the traffic coming from port 24. What I have done is as follows : Since the port 23 on the non Cisco switch is getting all the traffic which were mirrored from port 24, I have connected the port 23 to Switch port 4/1 on the 6500. On switch 6500, I have created span session using 4/1 as the source port and destination as the NAM module. But it doesnt seem to work. Any ideas. I tried connecting my PC to a port and tried mirroring port 4/1 to my pc's port, but no response. So it is not a problem with NAM config, but something else.

Please help...

[ankurbhasin]

Hi Rakesh,

I am not sure if non cisco switch supports RSPAN(Remote SPAN) technology or not. But if it supports the best option was to create a reflector port on non cisco switch and configure trunk between non cisco switch and cisco switch. And then Cisco NAM module will definetely work where you can capture your traffic.

[aashish.c]

Hi rakesh,

In this case, for trial purpose try connecting your sniffer PC to port 4/1 on 6500 and try to capture the packets.

Do not make any source port on 6500, and make 4/1 as destination port and check if it is capturing the packets or not. I assume that non-csico switch is acting like a hub.

kindly update.

regards

Aashish C

[rakeshsharma3000]

The non cisco switch is connected to port 4/1 of the 6500. So Cisco 6500 port 4/1 is the source port and 4/2 is the sniffer port, which will be the destination port. You mentioned not to make a source port. How will that work.