SPAN Port Destination

[mthomas777]

Hi,

I am new to creating a SPAN. When creating a span port destination on a Catalyst switch such as a 6509, does the destination port need to be setup as routed port (no switchport) or a switch port (eg: switchport, switchport access vlan x). The source port will be setup to capture VLAN and physical Interface traffic.

thanks.

[Julio E. Moisa]

Hi

The destination port (if you are going to connect a server or PC) should not have any configuration, it should be configured by default.

monitor session 1 source interface g1/x both

monitor session 1 destination interface g1/Y

or

monitor session 1 source vlan X both

monitor session 1 destination interface g1/Y

interface g1/Y

description SNIFFER

no shutdown

 * both is receiver/transmitter by default. Port and VLAN as source on the same session is not recommended. You will need 2 sessions. 

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swspan.html

https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html

Hope it is useful

:-)

[mthomas777]

Thank you so much Julio. This was really helpful.

[Julio E. Moisa]

Hi

Im glad to hear that, it was a pleasure,

Have a great day

:-)

[Julio E. Moisa]

Hi

Just a recommendation, try to don't mix VLAN and physical ports on the same session. 

The best option is create 2 sessions. 

monitor session 1 source interface g1/x both

monitor session 1 destination interface g1/Y

monitor session 2 source interface VLAN X both

monitor session 2 destination interface g1/Y

Or if you are going to monitor the VLAN X from a physical port like a trunk, you can make a filter. 

:-)

[mthomas777]

Hi Julio,

I wont. thanks for the suggestions.

[Julio E. Moisa]

You are welcome

:-)