cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
966
Views
0
Helpful
5
Replies
rkoudmani
Beginner

Help With Cisco 3750 Local Span Issue

Hi,

I am having an issue getting a local span session to work on a couple of my 3750's.  I have a very basic requirement to span one port to another and wireshark the destination port to grab some traces.  This is something I've done a thousand times but something is not working for me today in that I cannot see my return packets in my Wireshark trace.  I only see packets sourced from my local machines and no return packets even though I know they are there. i.e I see the ICMP request and no reply in the wireshark trace even though I have a ping reply on the host that initiated the ping.  There is no other route that the packets can take.

I have disabled all capture and dispaly filters on the wireshark laptop. I have used a couple of different lap tops to rule that out.  I have even tried to monitor on a different 3750 with similar results.  I feel its something I am missing in the 3750 monitor config but I can't put my finger on it and all looks good when I read the config guide.   Is there anything else I can try?!

IOS version 12.2 (25) and 12.2(42)

Config:-

monitor session 1 source interface Fa1/0/38
monitor session 1 destination interface Fa1/0/37

Session 1
---------
Type              : Local Session
Source Ports      :
    RX Only       : None
    TX Only       : None
    Both          : Fa1/0/38
Source VLANs      :
    RX Only       : None
    TX Only       : None
    Both          : None
Source RSPAN VLAN : None
Destination Ports : Fa1/0/37
    Encapsulation : Native
          Ingress : Disabled
Filter VLANs      : None
Dest RSPAN VLAN   : None

interface FastEthernet1/0/37
description Temp span Dest Port
speed 100
duplex full
spanning-tree portfast

interface FastEthernet1/0/38
description Span Soure Port

speed 100
duplex full

Thanks

RK

5 REPLIES 5
jiyonmathew
Beginner

Hi RK,

  Can you change the session number and also the source and destination ports if possible for try. I too had the same issue with one of my switch and was resolved like that.

Regards,

Jiyon

Hi Jiyon,

Thanks for you quick reply.  I was hoping it would be something like that but I tried configuring a monitor session 2 with a different source and destination interface and still have the same issue.

RK

hobbe
Rising star

Hi

You can span either the transmit or reiceve or both.

monitor session 1 source interface Fa1/0/38 both

should do the trick

Good luck and happy monitoring

HTH

Thanks Hobbe,

"Both" is the default when you don't stick in Tx or Rx and you can see in my output that Both is selected.  I even tried to include Both just for good measure but not that easy I;m afriad.

Thanks for your reply though.

Managed to get this working and it was all down to something to do with the laptops I was using.  In dispair I tried a third newer laptop this morning running wireshark version 1.2.6  and all is working nicely......Thanks to those who replied.