BGP peering resets after configuring Monitor session on 4500

[Ajitpal Sohal]

Not sure if this question should be posted here on this Community or not, if it needs to be moved somewhere please let me know.

We have a 4500 L3 Switch which runs BGP and EIGRP. The switch is running cat4500e-UNIVERSALK9-M version 3.4 SG.

We needed to sniff or capture the packets coming into one of the physical interface of the switch, for example TenGig 1/1 and send traffic to a server running WireShark. The monitor session was configured in this way:

monitor session # source inte tengig 1/1

monitor session # destination inter tengig 1/4 ---> Cable is run from here to WireShark NIC

Interface tengig 1/4 was configured only with the following commands (no access-vlan):

switchport

description

no shut

We had to disable the WireShark's NIC right away once we saw the BGP peer reset. It came back up after the NIC was disabled. 

Has anyone seen this issue before? This is something really unexpected, and happened on a production network. 

[Amit Goyal]

Hi Ajitpal,

I will suggest you to make a use of EEM scripts. You can use BGP reset logs as a trigger of this EEM script and remove "monitor session" commands as an action item.

You can use below link for help in EEM.

http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-event-manager-eem/116176-technote-eemscripts-00.html

HTH

-Amit