10-22-2013 09:09 PM - edited 03-07-2019 04:10 PM
I created 8 monitor sessions already with 1 destination port each, but I'm unable to create a 9th session. We have a lot of Proof of concepts running and do you know how i can do SPAN for multple destination hosts, more than 8?
I need a solution.... See config error below:
ROM: 15.0(1r)SG2
Jawa Revision 7, Snowtrooper Revision 0x0.0x15
NSEVCisco4500 uptime is 1 year, 9 weeks, 1 day, 12 hours, 6 minutes
System returned to ROM by power-on
Running default software
License Information for 'WS-X45-SUP7-E'
License Level: ipbase Type: Permanent
Next reboot license Level: ipbase
cisco WS-C4506-E (MPC8572) processor (revision 8) with 786516K/16384K bytes of memory.
Thanks
Edmund
Solved! Go to Solution.
10-22-2013 11:18 PM
Hi Edmund,
You can have a maximum of 8 sessions at the same time:
Note
Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Supervisor Engine 6L-E allow a maximum of 16 SPAN/RSPAN sessions ( 8 concurrent sessions with Rx sources and 8 concurrent sessions with Tx sources). Bidirectional sources count as both Rx and Tx. All other supervisor engines allow a maximum of 6 sessions (2 concurrent sessions with RX sources and 4 concurrent sessions with Txsources).
The only solution I can think of is to send SPAN traffic to RSPAN VLAN to another switch and run captures there as well. Or send traffic on a port to some kind of network tap with multiple ports.
10-22-2013 11:18 PM
Hi Edmund,
You can have a maximum of 8 sessions at the same time:
Note
Catalyst 4900M, Catalyst 4948E, Supervisor Engine 6-E, and Supervisor Engine 6L-E allow a maximum of 16 SPAN/RSPAN sessions ( 8 concurrent sessions with Rx sources and 8 concurrent sessions with Tx sources). Bidirectional sources count as both Rx and Tx. All other supervisor engines allow a maximum of 6 sessions (2 concurrent sessions with RX sources and 4 concurrent sessions with Txsources).
The only solution I can think of is to send SPAN traffic to RSPAN VLAN to another switch and run captures there as well. Or send traffic on a port to some kind of network tap with multiple ports.
10-23-2013 06:37 PM
Hi Daniel,
See attached for the solution overview.
Is that possible to do?
All switches will function as layer 2 except for the 6500 and the juniper SRX.
And just a bit of a background history, we currently have a 3560 switch that does all the SPAN session (connecting to the endace DAC) and we want to decomission that and replace it with 4506-E x2.
**Note: I did not design the topolgy as i ma just a new guy in the company**
Regards
Edmund
10-23-2013 11:38 PM
Yes, that's how I would do it to overcome the limitation. Looks good to me.
Daniel Dib
CCIE #37149
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide