cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
6557
Views
3
Helpful
3
Replies

Need help configuring Port Mirroring on 6509 IOS.

zeremy
Level 1
Level 1

Hi,

We're deploying a few cisco ids sensors on our network.

For some reason, I can't get port mirroring to work on our 6509 core switch running IOS 12.2(18)SXD2.

After configuring port mirroring based on cisco documentation, the destination span port line protocol went down.

Any ideas what went wrong?

coresw01#show version

Cisco Internetwork Operating System Software

IOS (tm) c6sup2_rp Software (c6sup2_rp-PSV-M), Version 12.2(18)SXD2, RELEASE SOFTWARE (fc1)

Technical Support: http://www.cisco.com/techsupport

Copyright (c) 1986-2004 by cisco Systems, Inc.

<...omitted...>

coresw01(config)#monitor session 1 source interface fastEthernet 9/19

coresw01(config)#monitor session 1 destination interface fastEthernet 9/23

coresw01#show monitor detail

Session 1

---------

Type : Local Session

Description : -

Source Ports :

RX Only : None

TX Only : None

Both : Fa9/19

Source VLANs :

RX Only : None

TX Only : None

Both : None

Source RSPAN VLAN : None

Destination Ports : Fa9/23

Filter VLANs : None

Destination RSPAN VLAN : None

coresw01#show interfaces fastEthernet 9/23

FastEthernet9/23 is up, line protocol is down (monitoring)

Hardware is C6k 100Mb 802.3, address is 00d0.008b.740a (bia 00d0.008b.740a)

Description: ids-4235 sniffing interface

MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

<..omitted...>

1 Accepted Solution

Accepted Solutions

amitsin
Cisco Employee
Cisco Employee

This is the way it works as it is a destination port so the line protocol goes to down state and also check the key word monitoring.

What is connected on port 9/19.

Can you send me the running config.

Check out the following link :

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/12_1e/swconfig/span.htm#61886

HTH

Amit Singh

View solution in original post

3 Replies 3

amitsin
Cisco Employee
Cisco Employee

This is the way it works as it is a destination port so the line protocol goes to down state and also check the key word monitoring.

What is connected on port 9/19.

Can you send me the running config.

Check out the following link :

http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/12_1e/swconfig/span.htm#61886

HTH

Amit Singh

Thanks!

Plugging a network analyzer on the port in question does confirm that the port is in a mirroring state.

Port 9/19 is one of our main uplinks.

Due to our security policy, we can't release the running config.

pedroquiroga
Level 1
Level 1

Hi, this is the normal operation on this switch,

line protocol is down (monitoring)

This means that the port is configured like a destination of a SPAN session. If you want you can put on this port an snnifer and you will see that the port mirror should be working fine.

Regards

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco