SPAN does not work properly

[andrecl]

I had a problem last night with my SPAN configuration.

I have a Cisco Catalyst 6000 running version 6.3(10) and I needed to listen to a Server traffic, so I mirrored its port to my Sniffer port, but it only listened the traffic in one way. I made all possible tests, changing port and changing Server.

I forced the command using the following line:

My Switch> set span <mod/port> <mod/port> both

Even so it doesn't work. :-(

So I put my Server and my Sniffer in a Cisco Catalyst 4000 and the capture worked well.

Does anyone know what can be happening ?

Is there any bug with this version in Cisco Cat 6000 ?

[kkalaycioglu]

I don't think it's software related, did you try it using another span destination port on 6000?

Regards.

[rejackson]

Try it again on the 6000 only span the vlan the server is on. If you see everything then the server probably has two connections and it transmitting on one and receiving on the other.

set span vlan# snifferport#

[andrecl]

Thanks for the idea Rejackson, but I also thought that could be that, and after some tests I saw hat the Server has only one connection in my LAN.

[kkalaycioglu]

Checked the bug toolkit but counldn't find something relevant to your problem. Anything unusual or suspicious about configuration of the span destination port?

[andrecl]

I tried and it wasn't worked...

I changed the port, after that I changed the Server too...and the results were the same.

Regards.