I need to set up a sniffer on a Cisco 3500XL switch. This sniffer needs to sniff out both sides of the conversation between a computer on the local switch, and a server that is on another subnet. So, the responses from the server will coming from the uplink side of the switch.
I have read about enabling the port monitor for the Cisco 3500XL. Here is my question, if I enable port monitoring on the port of the local switch to look at the local computer traffic, will I be seeing traffic from the server AND the computer coming out of my span port (where the sniffer is connected), or will I see transmits only from the local computer.
In short, do I need to span both the local computer port and the uplink port to the sniffer to get both sides of the data, or do I just need to span the local port?
Thanks!!
