creating a span port on cisco router 3640

[hasanbirol]

Hi,

i am running c3640-is-mz.124-21.bin on a cisco router 3640.

i am trying to create a monitor session in the CLI and everytime i type the command  

Router(config)#monitor session 1 interface ethernet2/1

% Invalid input detected at '^' marker.

Router(config)#monitor session 1 interface ethernet2/1
                                 ^
% Invalid input detected at '^' marker.

i get the error invalid input ?

any ideas what this can be

thanks

[cadet alain · Accepted solution]

Hi,

SPAN  is a switch feature.

Is this interface part of an ethernet switch module ?

if you want to sniff traffic on a routed port use this feature: http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html

Regards.

Alain

Don't forget to rate helpful posts.

[hasanbirol]

hi,

thanks for you response,

i am interested in ERSPAN, is this possible on my router 3640 running version c3640-is-mz.124-21.bin

regards

[cadet alain]

Hi,

No because  ERSPAN  is available only for  Catalyst 6500, 7600, Nexus, and ASR 1000 platforms.

Regards.

Alain

Don't forget to rate helpful posts.

[hasanbirol]

Hi,

what i do not understand is why does it let me get that far in entering the configuration for span port but then does not like it

Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#monitor session 1 ?
  destination  SPAN destination interface or VLAN
  filter       SPAN filter VLAN
  source       SPAN source interface or VLAN

Router(config)#monitor session 1 destination int ethernet2/1 both
                                                 ^
% Invalid input detected at '^' marker.

Router(config)#

it seems to not like when i enter ethernet 2/1?

[cadet alain]

Hi,

correct syntax is :

monitor session 1 source interface ethernet 2/1

Regards.

Alain

Don't forget to rate helpful posts.

[hasanbirol]

hi,

i just tried and got the same result

Router(config)#monitor session 1 source interface ethernet 2/1
                                                                         ^
% Invalid input detected at '^' marker.

Router(config)#

this is the interface (source)

Ethernet2/1                unassigned      YES manual up                    down -

[cadet alain]

Hi,

can you post a sh ver as well as sh run int ethernet2/1 and sh interface status

Regards.

Alain

Don't forget to rate helpful posts.

[hasanbirol]

sh ver
Cisco IOS Software, 3600 Software (C3640-IS-M), Version 12.4(21), RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Thu 10-Jul-08 04:59 by prod_rel_team

ROM: System Bootstrap, Version 11.1(20)AA2, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

Router uptime is 47 minutes
System returned to ROM by reload
System image file is "flash:c3640-is-mz.124-21.bin"

Cisco 3640 (R4700) processor (revision 0x00) with 98304K/32768K bytes of memory.
Processor board ID 22789884
R4700 CPU at 100MHz, Implementation 33, Rev 1.0
4 Ethernet interfaces
1 Serial interface
1 ISDN Basic Rate interface
1 Channelized E1/PRI port
DRAM configuration is 64 bits wide with parity disabled.
125K bytes of NVRAM.
32768K bytes of processor board System flash (Read/Write)
--More--                          
Configuration register is 0x3922

Router#sh run
Building configuration...

Current configuration : 886 bytes
!
version 12.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
no aaa new-model
memory-size iomem 25
!
ip traffic-export profile test
  interface Ethernet2/0
  bidirectional
! No destination mac-address configured
!
!
--More--                           ip cef
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
controller E1 3/0
!
!
!
!
interface BRI0/0
--More--                            no ip address
encapsulation hdlc
shutdown
!
interface Ethernet0/0
no ip address
shutdown
half-duplex
!
interface Ethernet0/1
no ip address
shutdown
half-duplex
!
interface Ethernet2/0
no ip address
full-duplex
!
interface Serial2/0
no ip address
shutdown
!
interface Ethernet2/1
--More--                            no ip address
full-duplex
!
ip http server
!
ip forward-protocol nd
!
!
!
!
!
control-plane
!
!
!
!
!
!
!
!
!
line con 0
speed 115200
--More--                           line aux 0
line vty 0 4
login
!
!
end

Router#sh int status

Router#sh ip int brief
Interface                  IP-Address      OK? Method Status                Protocol
BRI0/0                     unassigned      YES unset  administratively down down   
Ethernet0/0                unassigned      YES unset  administratively down down   
BRI0/0:1                   unassigned      YES unset  administratively down down   
BRI0/0:2                   unassigned      YES unset  administratively down down   
Ethernet0/1                unassigned      YES unset  administratively down down   
Ethernet2/0                unassigned      YES manual up                    down   
Serial2/0                  unassigned      YES unset  administratively down down   
Ethernet2/1                unassigned      YES manual up                    down   
Router#

[hasanbirol]

Router#sh run int ethernet2/1
Building configuration...

Current configuration : 57 bytes
!
interface Ethernet2/1
no ip address
full-duplex
end

[cadet alain]

Hi,

these are routed ports , I don't see any ethernet switch module installed. So this feature will not work with these interfaces like I said in my first reply.

Regards.

Alain

Don't forget to rate helpful posts.