12-14-2004 01:57 AM - edited 03-02-2019 08:34 PM
Hi,
We're deploying a few cisco ids sensors on our network.
For some reason, I can't get port mirroring to work on our 6509 core switch running IOS 12.2(18)SXD2.
After configuring port mirroring based on cisco documentation, the destination span port line protocol went down.
Any ideas what went wrong?
coresw01#show version
Cisco Internetwork Operating System Software
IOS (tm) c6sup2_rp Software (c6sup2_rp-PSV-M), Version 12.2(18)SXD2, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2004 by cisco Systems, Inc.
<...omitted...>
coresw01(config)#monitor session 1 source interface fastEthernet 9/19
coresw01(config)#monitor session 1 destination interface fastEthernet 9/23
coresw01#show monitor detail
Session 1
---------
Type : Local Session
Description : -
Source Ports :
RX Only : None
TX Only : None
Both : Fa9/19
Source VLANs :
RX Only : None
TX Only : None
Both : None
Source RSPAN VLAN : None
Destination Ports : Fa9/23
Filter VLANs : None
Destination RSPAN VLAN : None
coresw01#show interfaces fastEthernet 9/23
FastEthernet9/23 is up, line protocol is down (monitoring)
Hardware is C6k 100Mb 802.3, address is 00d0.008b.740a (bia 00d0.008b.740a)
Description: ids-4235 sniffing interface
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
<..omitted...>
Solved! Go to Solution.
12-14-2004 04:05 AM
This is the way it works as it is a destination port so the line protocol goes to down state and also check the key word monitoring.
What is connected on port 9/19.
Can you send me the running config.
Check out the following link :
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/12_1e/swconfig/span.htm#61886
HTH
Amit Singh
12-14-2004 04:05 AM
This is the way it works as it is a destination port so the line protocol goes to down state and also check the key word monitoring.
What is connected on port 9/19.
Can you send me the running config.
Check out the following link :
http://www.cisco.com/univercd/cc/td/doc/product/lan/cat6000/12_1e/swconfig/span.htm#61886
HTH
Amit Singh
12-14-2004 05:34 AM
Thanks!
Plugging a network analyzer on the port in question does confirm that the port is in a mirroring state.
Port 9/19 is one of our main uplinks.
Due to our security policy, we can't release the running config.
12-14-2004 05:18 AM
Hi, this is the normal operation on this switch,
line protocol is down (monitoring)
This means that the port is configured like a destination of a SPAN session. If you want you can put on this port an snnifer and you will see that the port mirror should be working fine.
Regards
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: